Principle of CC Attacks
The principle behind a CC attack is that attackers control certain hosts to continuously send a large number of data packets to the target server, exhausting its resources until it crashes. CC attacks primarily target web pages. Everyone has experienced this: when a webpage receives an unusually high number of visitors, loading becomes slow. A CC attack simulates multiple users (each thread represents one user) continuously accessing pages that require significant data operations (i.e., heavy CPU usage). This wastes server resources, causing the CPU to remain at 100% utilization with an endless stream of connections, leading to network congestion and interrupting normal access.
1. First Method
#!/bin/sh
IP=`tail -1000 access.log| awk ‘{print $1}’ | sort | uniq -c | sort -rn|awk ‘$1 > 100 {print $2}’`
for i in $IP
do
iptables -I INPUT -p tcp –dport 80 -s $i -j DROP
done
2. Second Method
#!/bin/sh
status=`netstat -na|awk ‘$5 ~ /[0-9]+:[0-9]+/ {print $5}’ |awk -F “:” — ‘{print $1}’ |sort -n|uniq -c |sort -n|tail -n 1`
NUM=`echo $status|awk ‘{print $1}’`
IP=`echo $status|awk ‘{print $2}’`
result=`echo “$NUM > 100” | bc`
if [ $result = 1 ]
then
echo IP:$IP is over $NUM, BAN IT! >> ip_deny.txt
/sbin/iptables -I INPUT -s $IP -j DROP
fi