If your server in under ddos, sometimes tcpdump is quit useful:
time tcpdump -tnn -c 20000 -i em1 | awk -F "." '{print $1 "." $2 "." $3 "." $4}' | sort | uniq -c | sort -nr | awk '$1 > 100'
ddos network monitor
Leave a reply
If your server in under ddos, sometimes tcpdump is quit useful:
time tcpdump -tnn -c 20000 -i em1 | awk -F "." '{print $1 "." $2 "." $3 "." $4}' | sort | uniq -c | sort -nr | awk '$1 > 100'