#!/bin/bash 
# 
# Use this script when your server is SYN-flooded 
# 
# Author: S. Poelwijk < poelwijk[at]mac.com > 
# Date: 30-10-2007 / version 1.0 
# 
# WARNING: This script will add ip addresses to iptables and 
#                restart Apache webserver without any further checks! 
#        
 
# Output all SYN connections to a temporary file 
netstat -an | grep SYN | awk '{print $5}' | awk -F: '{print $1}' 
| sort -n | uniq -c | sort -n > /tmp/syndos        
 
# Output all ips with more then 10 connections to the temporary 
# ip2block file 
cat syndos | awk '{ if ($1 &gt; 10) print $2 }' > /tmp/ips2block        
 
# Loop trough all this ip addresses and add them to iptables 
for i in $(cat /tmp/ips2block); do iptables -I INPUT -s $i -j DROP ; 
done        
 
# Restart apache to clear all SYN connections 
/etc/init.d/apache2 restart        
 
# Remove temporary files 
rm /tmp/syndos 
rm /tmp/ips2block        
 
# Check the number of filtered SYN packets 
iptables -L -n -v
