You are here: Home / How to VPS / centos / A powerful network analysis shell script

A powerful network analysis shell script

by Leave a Comment

This script features included are:
1, real-time monitor traffic on any network adapter
2, statistics within 10 seconds of the average flow
3, statistics the average flow rate for each port in less than 10 seconds, based on the client-side and server-side port statistics. Which sides you can see relatively large population flows, for a Web server, typically port 80. Other ports when they are attacked, and also possible other port traffic is relatively large. This feature can help us port traffic is normal.
4, counting in 10s of top 10 IP maximum occupied bandwidth. This feature can help us to find out whether there are malicious bandwidth–IP.
5, statistics connection States. This feature allows us to see which connection state is relatively large. If SYN-RECV more, and can be attacked by the semijoin. If ESTABLISED is very large, logs, but have found no more request, tcpdump, or have found plenty of IP does not ask for data, a connection is established, may have been influenced by the whole connection attacks, if you use nginx servers can increase listen 80 deferred configuration file to prevent.
6, counting each port connected. When the attack is possible, this feature can help us discover which ports are under attack.
7, statistics on port 80 and a status of ESTAB connections up to the first 10 IP. This feature can help us to find the create too many Ip connections, and shield.
8, statistics on port 80 with a status of SYN-RECV number of connections up to the first 10 IP. When the attack is half-connection, this feature can help us find malicious IP.
Web analytics tool used:
1, tcpdump: this script is to use tcpdump to statistics based on the IP or port–based traffic.
2, SS: SS command for this script to count the connection status, the actual use of discover more SS than netstat efficiently.
3,/proc/NET/dev, used statistics to specify network card flow.
Scripting download: https://www.CentOS.bz/WP-content/uploads/2014/06/network-analysis.sh
Posted below the complete script:
  1. #!/bin/bash
  3. #write by zhumaohai(admin#centos.bz)
  4. #author blog: www.centos.bz
  7. #Display (Radio)
  8. display_menu(){
  9. local soft=$1
  10. local prompt=”which ${soft} you’d select: “
  11. eval local arr=(\${${soft}_arr[@]})
  12. while true
  13. do
  14.     echo -e “#################### ${soft} setting ####################\n\n”
  15.     for ((i=1;i<=${#arr[@]};i++ )); do echo -e “$i) ${arr[$i-1]}”; done
  16.     echo
  17.     read -p “${prompt}” $soft
  18.     eval local select=\$$soft
  19.     if [ “$select” == “” ] || [ “${arr[$soft-1]}” == “”  ];then
  20.         prompt=”input errors,please input a number: “
  21.     else
  22.         eval $soft=${arr[$soft-1]}
  23.         eval echo “your selection: \$$soft”
  24.         break
  25.     fi
  26. done
  27. }
  29. # The bandwidth of a human-bit unit unit
  30. bit_to_human_readable(){
  31.     #input bit value
  32.     local trafficValue=$1
  34.     if [[ ${trafficValue%.*} -gt 922 ]];then
  35.         #conv to Kb
  36.         trafficValue=awk -v value=$trafficValue 'BEGIN{printf "%0.1f",value/1024}'
  37.         if [[ ${trafficValue%.*} -gt 922 ]];then
  38.             #conv to Mb
  39.             trafficValue=awk -v value=$trafficValue 'BEGIN{printf "%0.1f",value/1024}'
  40.             echo “${trafficValue}Mb”
  41.         else
  42.             echo “${trafficValue}Kb”
  43.         fi
  44.     else
  45.         echo “${trafficValue}b”
  46.     fi
  47. }
  49. # Judge package management tools
  50. check_package_manager(){
  51.     local manager=$1
  52.     local systemPackage=”
  53.     if cat /etc/issue | grep -q -E -i “ubuntu|debian”;then
  54.         systemPackage=’apt’
  55.     elif cat /etc/issue | grep -q -E -i “centos|red hat|redhat”;then
  56.         systemPackage=’yum’
  57.     elif cat /proc/version | grep -q -E -i “ubuntu|debian”;then
  58.         systemPackage=’apt’
  59.     elif cat /proc/version | grep -q -E -i “centos|red hat|redhat”;then
  60.         systemPackage=’yum’
  61.     else
  62.         echo “unkonw”
  63.     fi
  65.     if [ “$manager” == “$systemPackage” ];then
  66.         return 0
  67.     else
  68.         return 1
  69.     fi
  70. }
  73. # Real-time traffic
  74. realTimeTraffic(){
  75.     local eth=””
  76.     local nic_arr=(ifconfig | grep -E -o "^[a-z0-9]+" | grep -v "lo" | uniq)
  77.     local nicLen=${#nic_arr[@]}
  78.     if [[ $nicLen -eq 0 ]]; then
  79.         echo “sorry,I can not detect any network device,please report this issue to author.”
  80.         exit 1
  81.     elif [[ $nicLen -eq 1 ]]; then
  82.         eth=$nic_arr
  83.     else
  84.         display_menu nic
  85.         eth=$nic
  86.     fi
  88.     local clear=true
  89.     local eth_in_peak=0
  90.     local eth_out_peak=0
  91.     local eth_in=0
  92.     local eth_out=0
  94.     while true;do
  95.         # Move the cursor to 0: 0 Location
  96.         printf “\033[0;0H”
  97.         # Clear the screen and print Now Peak
  98.         [[ $clear == true ]] && printf “\033[2J” && echo “$eth——–Now——–Peak———–“
  99.         traffic_be=(awk -v eth=$eth -F'[: ]+' '{if ($0 ~eth){print $3,$11}}' /proc/net/dev)
  100.         sleep 2
  101.         traffic_af=(awk -v eth=$eth -F'[: ]+' '{if ($0 ~eth){print $3,$11}}' /proc/net/dev)
  102.         # Computation rate
  103.         eth_in=$(( (${traffic_af[0]}-${traffic_be[0]})*8/2 ))
  104.         eth_out=$(( (${traffic_af[1]}-${traffic_be[1]})*8/2 ))
  105.       # Calculate peak flow
  106.         [[ $eth_in -gt $eth_in_peak ]] && eth_in_peak=$eth_in
  107.         [[ $eth_out -gt $eth_out_peak ]] && eth_out_peak=$eth_out
  108.         # Move the cursor to 2: 1
  109.         printf “\033[2;1H”
  110.         # Clear the current row
  111.         printf “\033[K”
  112.         printf “%-20s %-20s\n” “Receive:  $(bit_to_human_readable $eth_in)” “$(bit_to_human_readable $eth_in_peak)”
  113.        # Clear the current row
  114.         printf “\033[K”
  115.         printf “%-20s %-20s\n” “Transmit: $(bit_to_human_readable $eth_out)” “$(bit_to_human_readable $eth_out_peak)”
  116.         [[ $clear == true ]] && clear=false
  117.     done
  118. }
  120. # Flow and connection Overview
  121. trafficAndConnectionOverview(){
  122.     if ! which tcpdump > /dev/null;then
  123.         echo “tcpdump not found,going to install it.”
  124.         if check_package_manager apt;then
  125.             apt-get -y install tcpdump
  126.         elif check_package_manager yum;then
  127.             yum -y install tcpdump
  128.         fi
  129.     fi
  131.     local reg=””
  132.     local eth=””
  133.     local nic_arr=(ifconfig | grep -E -o "^[a-z0-9]+" | grep -v "lo" | uniq)
  134.     local nicLen=${#nic_arr[@]}
  135.     if [[ $nicLen -eq 0 ]]; then
  136.         echo “sorry,I can not detect any network device,please report this issue to author.”
  137.         exit 1
  138.     elif [[ $nicLen -eq 1 ]]; then
  139.         eth=$nic_arr
  140.     else
  141.         display_menu nic
  142.         eth=$nic
  143.     fi
  145.     echo “please wait for 10s to generate network data…”
  146.     echo
  147.    # The current flow rate value
  148.     local traffic_be=(awk -v eth=$eth -F'[: ]+' '{if ($0 ~eth){print $3,$11}}' /proc/net/dev)
  149.     #tcpdump monitor network
  150.     tcpdump -v -i $eth -tnn > /tmp/tcpdump_temp 2>&1 &
  151.     sleep 10
  152.     clear
  153.     kill ps aux | grep tcpdump | grep -v grep | awk '{print $2}'
  155.     # Flow value after 10s
  156.     local traffic_af=(awk -v eth=$eth -F'[: ]+' '{if ($0 ~eth){print $3,$11}}' /proc/net/dev)
  157.     # Print 10s average rate
  158.     local eth_in=$(( (${traffic_af[0]}-${traffic_be[0]})*8/10 ))
  159.     local eth_out=$(( (${traffic_af[1]}-${traffic_be[1]})*8/10 ))
  160.     echo -e “\033[32mnetwork device $eth average traffic in 10s: \033[0m”
  161.     echo “$eth Receive: $(bit_to_human_readable $eth_in)/s”
  162.     echo “$eth Transmit: $(bit_to_human_readable $eth_out)/s”
  163.     echo
  165.     local regTcpdump=$(ifconfig | grep -A 1 $eth | awk -F'[: ]+’ ‘$0~/inet addr:/{printf $4″|”}’ | sed -e ‘s/|$//’ -e ‘s/^/(/’ -e ‘s/$/)\\\\\.[0-9]+:/’)
  167.    # Old version of tcpdump output format is not the same as dealing respectively
  168.     if awk ‘/^IP/{print;exit}’ /tmp/tcpdump_temp | grep -q “)$”;then
  169.         # Handle tcpdump file
  170.         awk ‘/^IP/{print;getline;print}’ /tmp/tcpdump_temp > /tmp/tcpdump_temp2
  171.     else
  172.        # Handle tcpdump file
  173.         awk ‘/^IP/{print}’ /tmp/tcpdump_temp > /tmp/tcpdump_temp2
  174.         sed -i -r ‘s#(.*: [0-9]+\))(.*)#\1\n    \2#’ /tmp/tcpdump_temp2
  175.     fi
  177.     awk ‘{len=$NF;sub(/\)/,””,len);getline;print $0,len}’ /tmp/tcpdump_temp2 > /tmp/tcpdump
  179.     # Statistics for each port of the average flow rate in the 10s
  180.     echo -e “\033[32maverage traffic in 10s base on server port: \033[0m”
  181.     awk -F'[ .:]+’ -v regTcpdump=$regTcpdump ‘{if ($0 ~ regTcpdump){line=”clients > “$8″.”$9″.”$10″.”$11″:”$12}else{line=$2″.”$3″.”$4″.”$5″:”$6″ > clients”};sum[line]+=$NF*8/10}END{for (line in sum){printf “%s %d\n”,line,sum[line]}}’ /tmp/tcpdump | \
  182.     sort -k 4 -nr | head -n 10 | while read a b c d;do
  183.         echo “$a $b $c $(bit_to_human_readable $d)/s”
  184.     done
  185.     echo -ne “\033[11A”
  186.     echo -ne “\033[50C”
  187.     echo -e “\033[32maverage traffic in 10s base on client port: \033[0m”
  188.     awk -F'[ .:]+’ -v regTcpdump=$regTcpdump ‘{if ($0 ~ regTcpdump){line=$2″.”$3″.”$4″.”$5″:”$6″ > server”}else{line=”server > “$8″.”$9″.”$10″.”$11″:”$12};sum[line]+=$NF*8/10}END{for (line in sum){printf “%s %d\n”,line,sum[line]}}’ /tmp/tcpdump | \
  189.     sort -k 4 -nr | head -n 10 | while read a b c d;do
  190.             echo -ne “\033[50C”
  191.             echo “$a $b $c $(bit_to_human_readable $d)/s”
  192.     done
  194.     echo
  196.    # Statistics bandwidth of previous 10 ip largest in the 10s
  197.     echo -e “\033[32mtop 10 ip average traffic in 10s base on server: \033[0m”
  198.     awk -F'[ .:]+’ -v regTcpdump=$regTcpdump ‘{if ($0 ~ regTcpdump){line=$2″.”$3″.”$4″.”$5″ > “$8″.”$9″.”$10″.”$11″:”$12}else{line=$2″.”$3″.”$4″.”$5″:”$6″ > “$8″.”$9″.”$10″.”$11};sum[line]+=$NF*8/10}END{for (line in sum){printf “%s %d\n”,line,sum[line]}}’ /tmp/tcpdump | \
  199.     sort -k 4 -nr | head -n 10 | while read a b c d;do
  200.         echo “$a $b $c $(bit_to_human_readable $d)/s”
  201.     done
  202.     echo -ne “\033[11A”
  203.     echo -ne “\033[50C”
  204.     echo -e “\033[32mtop 10 ip average traffic in 10s base on client: \033[0m”
  205.     awk -F'[ .:]+’ -v regTcpdump=$regTcpdump ‘{if ($0 ~ regTcpdump){line=$2″.”$3″.”$4″.”$5″:”$6″ > “$8″.”$9″.”$10″.”$11}else{line=$2″.”$3″.”$4″.”$5″ > “$8″.”$9″.”$10″.”$11″:”$12};sum[line]+=$NF*8/10}END{for (line in sum){printf “%s %d\n”,line,sum[line]}}’ /tmp/tcpdump | \
  206.     sort -k 4 -nr | head -n 10 | while read a b c d;do
  207.         echo -ne “\033[50C”
  208.         echo “$a $b $c $(bit_to_human_readable $d)/s”
  209.     done
  211.     echo
  212.    # Statistics connection status
  213.     local regSS=$(ifconfig | grep -A 1 $eth | awk -F'[: ]+’ ‘$0~/inet addr:/{printf $4″|”}’ | sed -e ‘s/|$//’)
  214.     ss -an | grep -v -E “LISTEN|UNCONN” | grep -E “$regSS” > /tmp/ss
  215.     echo -e “\033[32mconnection state count: \033[0m”
  216.     awk ‘NR>1{sum[$(NF-4)]+=1}END{for (state in sum){print state,sum[state]}}’ /tmp/ss | sort -k 2 -nr
  217.     echo
  218.     # Statistical connection status of each port
  219.     echo -e “\033[32mconnection state count by port base on server: \033[0m”
  220.     awk ‘NR>1{sum[$(NF-4),$(NF-1)]+=1}END{for (key in sum){split(key,subkey,SUBSEP);print subkey[1],subkey[2],sum[subkey[1],subkey[2]]}}’ /tmp/ss | sort -k 3 -nr | head -n 10
  221.     echo -ne “\033[11A”
  222.     echo -ne “\033[50C”
  223.     echo -e “\033[32mconnection state count by port base on client: \033[0m”
  224.     awk ‘NR>1{sum[$(NF-4),$(NF)]+=1}END{for (key in sum){split(key,subkey,SUBSEP);print subkey[1],subkey[2],sum[subkey[1],subkey[2]]}}’ /tmp/ss | sort -k 3 -nr | head -n 10 | awk ‘{print “\033[50C”$0}’
  225.     echo
  226.     # Statistics port 80 and the status of the largest number of connections before ESTAB 10 IP
  227.     echo -e “\033[32mtop 10 ip ESTAB state count at port 80: \033[0m”
  228.     cat /tmp/ss | grep ESTAB | awk -F'[: ]+’ ‘{sum[$(NF-2)]+=1}END{for (ip in sum){print ip,sum[ip]}}’ | sort -k 2 -nr | head -n 10
  229.     echo
  230.    # Statistics port 80 and the status of the largest number of connections SYN-RECV before 10 IP
  231.     echo -e “\033[32mtop 10 ip SYN-RECV state count at port 80: \033[0m”
  232.     cat /tmp/ss | grep -E “$regSS” | grep SYN-RECV | awk -F'[: ]+’ ‘{sum[$(NF-2)]+=1}END{for (ip in sum){print ip,sum[ip]}}’ | sort -k 2 -nr | head -n 10
  233. }
  235. main(){
  236.     while true; do
  237.         echo -e “1) real time traffic.\n2) traffic and connection overview.\n”
  238.         read -p “please input your select(ie 1): ” select
  239.         case  $select in
  240.             1) realTimeTraffic;break;;
  241.             2) trafficAndConnectionOverview;break;;
  242.             *) echo “input error,please input a number.”;;
  243.         esac
  244.     done
  245. }
  247. main

Leave a Reply

Your email address will not be published. Required fields are marked *