2년전에 공유된 자료이며… 올려놓으신분께서는 DDOS Monitor 라고 설명을 달아두었지만 그러기에는 거시기하고 동일한 아이피에서 접속자 추출하는 용도로 사용하면 딱일듯 싶습니다.
요즘은 계속 Ubuntu 환경에서만 작업을 해서 CentOS/RHEL 계열에서는 테스트 안되었습니다.
참고 URL : https://github.com/edubart/ddosmon
설치는 심플하니….스크립트 구동에 필요한 패키지 설치하고 소스 컴파일해서 실행시키면 됩니다.
smileserv@CHONNOM_OFFICE:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DEscRIPTION=”Ubuntu 14.04.3 LTS”
# git clone https://github.com/edubart/ddosmon.git ddosmon
# cd ddosmon
# mkdir build
# apt-get install cmake libboost-all-dev
# apt-get install liblua5.1-0-dev libncurses5-dev
아래처럼 에러없이 똑떨어지면 끝….
# cmake ..
— Boost version: 1.54.0
— Found the following Boost libraries:
— thread
— system
— Configuring done
— Generating done
— Build files have been written to: /home/ddosmon/build
— Boost version: 1.54.0
— Found the following Boost libraries:
— thread
— system
— Configuring done
— Generating done
— Build files have been written to: /home/ddosmon/build
# make
[ 7%] Building CXX object CMakeFiles/ddosmon.dir/src/configmanager.cpp.o
[ 15%] Building CXX object CMakeFiles/ddosmon.dir/src/screen.cpp.o
[ 15%] Building CXX object CMakeFiles/ddosmon.dir/src/screen.cpp.o
…………….
…………….
inking CXX executable ddosmon
[100%] Built target ddosmon
[100%] Built target ddosmon
# mkdir ../logs
# cd ..
설정파일등은 시스템에 맞게…적당히 수정해서 이용하세요~ ^^;
./configs/example.lua
./scripts/networkcompromise
./scripts/notificate
./scripts/ipblock
# cat configs/example.lua
interface = “eth0”
global_traffic_threshold = 900000
global_packets_threshold = 30
ip_traffic_threshold = 500000
ip_packets_threshold = 125000
notification_traffic_threshold = 20000
notification_packets_threshold = 30
ipblock_retry_ticks = 5*3600*1000
notification_command = “./scripts/notificate \”%1%\” \”%2%\” &”
onblockip_command = “./scripts/ipblock block %1% &”
onunblockip_command = “./scripts/ipblock unblock %1% &”
network_uncompromise_ticks = 30
onnetwork_compromise_command = “./scripts/networkcompromise compromised &”
onnetwork_uncompromise_command = “./scripts/networkcompromise uncompromised &”
log=”logs/example.log”
watchedips=”configs/example_watchedips.xml”
notificationsubject=”DDOS Monitor on server1 notification”
실행
# ./build/ddosmon configs/example.lua
