# Detect if an attack is in progress…

netstat -plant
– Filtra per IP
netstat -plant |grep -c 185.11.147.63

– Filtra per utente hosting
ps faux |grep paganico

# Counts connections for IP [ottimo modo per contare le sessioni per IP]
netstat -anp |grep 'tcp|udp' | awk '{print $5}' | sed s/::ffff:// | cut -d: -f1 | sort | uniq -c | sort -n

# Sessions count for IP
netstat -nA inet |awk '/^[ut]/{split($5,a,":");print a[1]}'|sort |uniq -c |sort -n

#To view the total number of connections to a port, run the following command in ssh
netstat -tuna | awk -F':+| +' 'NR>2{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

#To view  the total number of connections from a single ip, run the following command in ssh
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

#Show number of connections by state
netstat -nat | awk '{print $6}' | sort | uniq -c | sort -n

#Show all IPs connected
netstat -nat | awk '{ print $5}' | cut -d: -f1 | sed -e '/^$/d' | uniq

#Show number of connections per IP
netstat -atun | awk '{print $5}' | cut -d: -f1 | sed -e '/^$/d' |sort | uniq -c | sort -n 

#Per installare CSF su cPanel

To install CSF, run the following at the command line as the root user:

#wget http://configserver.com/free/csf.tgz
#tar -xzf csf.tgz
#cd csf & ./install.cpanel.sh

To configure CSF, use WHM's ConfigServer & Firewall interface (Home >> Plugins >> ConfigServer & Firewall).

SYNFLOOD = “1″
SYNFLOOD_RATE = “30/s”
SYNFLOOD_BURST = “10″
PORTFLOOD = 80;tcp;100;5,22;tcp;5;300

CT_LIMIT = 50 (25 forse è meglio)
CT_INTERVAL = 30
CT_PORTS = 80,443 (non mettere niente per tutte le porte)

 Porte configurate attualmente sui server cPanel

TCP_IN = 20,21,22,25,26,53,80,110,143,443,465,587,783,990,993,995,2077,2078,2079,2080,2082,2083,2086,2087,2095,2096,30000:50000
TCP_OUT = 20,21,22,25,26,37,43,53,80,111,113,443,465,587,873,990,2049,2077,2078,2079,2080,2089,2195,2703,30000:50000

UDP_IN = 53,161,465,783
UDP_OUT = 53,111,123,161,465,873,2049,20048,30000,33434:33523