linux ddos attack and blocking

Question

im checking ddos using this script:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

it will show something like this

24 220.160.239.126
25 42.80.231.240
26 182.109.15.223
29 218.64.39.93

im blocking the ip using:

route add 218.64.39.93 reject

how do i combine the checking netstat with the route add reject if the count more than 20.

thanks

Answer 1

Append:

|awk '$1 > 20 {print $2}'

to print the entry in the second column of your input when the integer in the first column exceeds the value of 20.

|awk '$1 > 20 {print "route add " $2 " reject"}' | /bin/sh

and omitting the redundant | sort -n would be a refinement to execute the desired command.

By the way DIY DOS protection like that is probably not the optimal solution...