网络入侵检测

netstat -anlp | grep 80 | grep tcp | awk '{print $5}' | awk -F: '{print $1}' |sort | uniq -c | sort -nr | head -n20 netstat -ant | awk '/:80/{split($5,ip,":");++A[ip[1]]} END {for(i in A) print A[i],i}'  | sort -rn | head -n 20

tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -F"." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr |head -20