#!/bin/bash

#
# Block all IP addresses that flood the system logs with 'Treason uncloaked' messages. 
#
# More information about the messages can be found at:
#  - http://www.redhatmagazine.com/2007/01/29/why-do-i-get-tcp-treason-uncloaked-messages-in-my-system-logs/
#  - http://www.informedbanking.com/acc/nxwiki/view/TCP-Treason-Uncloaked.html
#
# To activate, replace the 'echo' line with the 'iptables' line.
#

for ATTACKER_IP in $(dmesg | grep 'Treason uncloaked!' | cut -d' ' -f5 | cut -d':' -f1 | sort --unique)
do
#iptables -A INPUT -s $ATTACKER_IP -j DROP
echo $ATTACKER_IP
done
