linux tips: a one liner, who attacked me today?
Monday, January 22nd, 2007i got pretty tight iptables rules set, and all un desired packets are logged through ulog. below is one liner command(s) to check who ‘attacked’ (not exactly attack, there were all un wanted packets actually) me today:
for i in `grep “PROTO=UDP” /var/log/ulog/syslogemu.log | sed “s/^.*SRC=//g” | sed “s/DST=.*$//g” | sort | uniq` ; do echo `grep $i /var/log/ulog/syslogemu.log | wc -l ` ” ” $i >> attacker.txt ; done ; sort -r -n -k 1 attacker.txt > tmp ; mv tmp attacker.txt
Bookmark to:
