\r\n# \u4f7f\u7528\u8be6\u7ec6\u65f6\u95f4\u6355\u83b7HTTP\u6d41\u91cf\r\ntcpdump -i any -w capture.pcap 'port 80 or port 443' -ttt\r\n\r\n# \u5206\u6790\u7279\u5b9a\u5b50\u7f51\u6d41\u91cf\r\ntcpdump net 192.168.1.0\/24\r\n\r\n# \u76d1\u63a7\u7279\u5b9a\u5e94\u7528\u7a0b\u5e8f\u6d41\u91cf\r\ntcpdump port 3306 -vv\r\n<\/code><\/pre>\n
\u5b9e\u73b0\u5b9e\u65f6\u76d1\u63a7\u7cfb\u7edf<\/strong><\/h2>\n
\r\n#!\/bin\/bash\r\n\r\n# \u6d1b\u6749\u77f6\u670d\u52a1\u5668\u9ad8\u7ea7\u76d1\u63a7\u811a\u672c\r\nLOG_FILE=\"\/var\/log\/nginx\/access.log\"\r\nALERT_THRESHOLD=1000\r\nEMAIL=\"admin@example.com\"\r\n\r\nmonitor_traffic() {\r\n    while true; do\r\n        CONNECTIONS=$(netstat -an | grep ESTABLISHED | wc -l)\r\n        MEMORY_USAGE=$(free -m | awk 'NR==2{printf \"%.2f%%\", $3*100\/$2}')\r\n        \r\n        if [ $CONNECTIONS -gt $ALERT_THRESHOLD ]; then\r\n            echo \"\u9ad8\u6d41\u91cf\u8b66\u62a5\uff1a$CONNECTIONS \u4e2a\u6d3b\u52a8\u8fde\u63a5\" | \\\r\n            mail -s \"\u6d41\u91cf\u8b66\u62a5\" $EMAIL\r\n        fi\r\n        \r\n        echo \"$(date): \u8fde\u63a5\u6570=$CONNECTIONS, \u5185\u5b58=$MEMORY_USAGE\"\r\n        sleep 60\r\n    done\r\n}\r\n\r\nmonitor_traffic &\r\n<\/code><\/pre>\n
\u6d1b\u6749\u77f6\u9ad8\u5cf0\u65f6\u6bb5\u6d41\u91cf\u6a21\u5f0f\u5206\u6790<\/strong><\/h2>\n
\u6d1b\u6749\u77f6\u670d\u52a1\u5668\u7ecf\u5386\u72ec\u7279\u7684\u6d41\u91cf\u6a21\u5f0f\uff0c\u539f\u56e0\u5982\u4e0b\uff1a<\/p>\n
\n
\u5a31\u4e50\u4e1a\u6e32\u67d3\u519c\u573a\u8fd0\u8425\uff08\u901a\u5e38\u592a\u5e73\u6d0b\u6807\u51c6\u65f6\u95f418:00-06:00\uff09<\/li>\n
\u4e9a\u6d32\u5e02\u573a\u4ea4\u6613\u65f6\u95f4\uff08\u592a\u5e73\u6d0b\u6807\u51c6\u65f6\u95f417:00-01:00\uff09<\/li>\n
\u6b27\u6d32\u5e02\u573a\u5f00\u76d8\u91cd\u53e0\u65f6\u95f4\uff08\u592a\u5e73\u6d0b\u6807\u51c6\u65f6\u95f423:00-02:00\uff09<\/li>\n
\u672c\u5730\u4e1a\u52a1\u9ad8\u5cf0\u65f6\u95f4\uff08\u592a\u5e73\u6d0b\u6807\u51c6\u65f6\u95f409:00-17:00\uff09<\/li>\n<\/ul>\n
\r\nimport pandas as pd\r\nimport matplotlib.pyplot as plt\r\nfrom datetime import datetime\r\n\r\ndef analyze_la_traffic(log_file):\r\n    # \u8bfb\u53d6\u5e26\u65f6\u533a\u610f\u8bc6\u7684\u65e5\u5fd7\u6587\u4ef6\r\n    df = pd.read_csv(log_file, \r\n                     parse_dates=['timestamp'],\r\n                     date_parser=lambda x: pd.to_datetime(x, utc=True))\r\n    \r\n    # \u8f6c\u6362\u4e3a\u6d1b\u6749\u77f6\u65f6\u95f4\r\n    df['local_time'] = df['timestamp'].dt.tz_convert('America\/Los_Angeles')\r\n    df['hour'] = df['local_time'].dt.hour\r\n    \r\n    # \u5206\u6790\u6bcf\u5c0f\u65f6\u6a21\u5f0f\r\n    hourly_traffic = df.groupby('hour').size()\r\n    \r\n    # \u8bc6\u522b\u9ad8\u5cf0\u65f6\u6bb5\r\n    peak_hours = hourly_traffic[hourly_traffic > hourly_traffic.mean() + hourly_traffic.std()]\r\n    \r\n    return hourly_traffic, peak_hours\r\n\r\n# \u4f7f\u7528\u793a\u4f8b\r\ntraffic_data, peaks = analyze_la_traffic('access.log')\r\n<\/code><\/pre>\n
\u6d1b\u6749\u77f6\u6570\u636e\u4e2d\u5fc3\u589e\u5f3a\u5b89\u5168\u76d1\u63a7<\/strong><\/h2>\n
\u7531\u4e8e\u6d1b\u6749\u77f6\u670d\u52a1\u5668\u662f\u9ad8\u4ef7\u503c\u76ee\u6807\uff0c\u9700\u8981\u5f3a\u5927\u7684\u5b89\u5168\u76d1\u63a7\u3002\u5b9e\u65bd\u4ee5\u4e0b\u9ad8\u7ea7\u5b89\u5168\u63aa\u65bd\uff1a<\/p>\n
\r\n#!\/bin\/bash\r\n\r\n# \u9ad8\u7ea7\u5b89\u5168\u76d1\u63a7\u811a\u672c\r\nLOG_DIR=\"\/var\/log\"\r\nTHRESHOLD=100\r\nBLOCK_TIME=3600\r\n\r\nmonitor_security() {\r\n    # \u76d1\u63a7\u591a\u4e2a\u653b\u51fb\u5411\u91cf\r\n    tail -f $LOG_DIR\/auth.log $LOG_DIR\/nginx\/access.log | \\\r\n    grep -E \"Failed password|POST \/wp-login|SELECT FROM|\/phpMyAdmin\" | \\\r\n    while read line; do\r\n        IP=$(echo $line | grep -oE \"\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b\")\r\n        if [ ! -z \"$IP\" ]; then\r\n            COUNT=$(grep \"$IP\" $LOG_DIR\/auth.log | wc -l)\r\n            if [ $COUNT -gt $THRESHOLD ]; then\r\n                iptables -A INPUT -s $IP -j DROP\r\n                echo \"$(date): \u5df2\u5c01\u7981 $IP\uff0c\u539f\u56e0\uff1a\u53ef\u7591\u6d3b\u52a8\"\r\n                # \u8ba1\u5212\u89e3\u5c01\r\n                at now + $BLOCK_TIME seconds << EOF\r\n                iptables -D INPUT -s $IP -j DROP\r\nEOF\r\n            fi\r\n        fi\r\n    done\r\n}\r\n\r\nmonitor_security &\r\n<\/code><\/pre>\n
\u5a92\u4f53\u5bc6\u96c6\u578b\u6d41\u91cf\u7684\u5e26\u5bbd\u4f18\u5316<\/strong><\/h2>\n
\u4e3a\u6d1b\u6749\u77f6\u7684\u5a92\u4f53\u5bc6\u96c6\u578b\u73af\u5883\u4f18\u5316\u5e26\u5bbd\u4f7f\u7528\uff1a<\/p>\n
\r\n# Nginx\u5a92\u4f53\u4f18\u5316\u914d\u7f6e\r\nhttp {\r\n    # \u9ad8\u7ea7\u538b\u7f29\u8bbe\u7f6e\r\n    gzip on;\r\n    gzip_vary on;\r\n    gzip_min_length 1000;\r\n    gzip_proxied expired no-cache no-store private auth;\r\n    gzip_types text\/plain text\/css application\/json application\/javascript application\/x-javascript text\/xml application\/xml application\/xml+rss text\/javascript image\/svg+xml;\r\n    gzip_comp_level 6;\r\n\r\n    # \u6d4f\u89c8\u5668\u7f13\u5b58\r\n    map $sent_http_content_type $expires {\r\n        default                    off;\r\n        text\/html                  epoch;\r\n        text\/css                   max;\r\n        application\/javascript     max;\r\n        ~image\/                    max;\r\n        ~video\/                    30d;\r\n        ~audio\/                    30d;\r\n    }\r\n\r\n    server {\r\n        location ~* \\.(jpg|jpeg|png|gif|ico|css|js|mp4)$ {\r\n            expires $expires;\r\n            add_header Cache-Control \"public, no-transform\";\r\n            add_header X-Frame-Options \"SAMEORIGIN\";\r\n            add_header X-XSS-Protection \"1; mode=block\";\r\n        }\r\n        \r\n        # \u5a92\u4f53\u6d41\u4f18\u5316\r\n        location \/videos\/ {\r\n            mp4;\r\n            mp4_buffer_size 1m;\r\n            mp4_max_buffer_size 5m;\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\n
\u81ea\u52a8\u6027\u80fd\u5206\u6790<\/strong><\/h2>\n
\r\nimport sys\r\nimport re\r\nfrom collections import defaultdict\r\nfrom datetime import datetime, timezone\r\nimport pytz\r\n\r\nclass LAServerAnalyzer:\r\n    def __init__(self):\r\n        self.ip_stats = defaultdict(lambda: {\r\n            'count': 0,\r\n            'bytes': 0,\r\n            'status_codes': defaultdict(int)\r\n        })\r\n        self.hourly_traffic = defaultdict(int)\r\n        self.response_times = []\r\n        self.la_tz = pytz.timezone('America\/Los_Angeles')\r\n    \r\n    def analyze_line(self, line):\r\n        patterns = {\r\n            'ip': r'(\\d+\\.\\d+\\.\\d+\\.\\d+)',\r\n            'time': r'\\[(\\d+\/\\w+\/\\d+:\\d+:\\d+:\\d+)',\r\n            'status': r'\" (\\d{3}) ',\r\n            'bytes': r'\" \\d{3} (\\d+)',\r\n            'response_time': r'\" \\d{3} \\d+ \"(\\d+\\.\\d+)\"'\r\n        }\r\n        \r\n        matches = {k: re.search(v, line) for k, v in patterns.items()}\r\n        \r\n        if all(matches.values()):\r\n            ip = matches['ip'].group(1)\r\n            time_str = matches['time'].group(1)\r\n            status = matches['status'].group(1)\r\n            bytes_sent = int(matches['bytes'].group(1))\r\n            response_time = float(matches['response_time'].group(1))\r\n            \r\n            # \u8f6c\u6362\u4e3a\u6d1b\u6749\u77f6\u65f6\u95f4\r\n            utc_time = datetime.strptime(time_str, '%d\/%b\/%Y:%H:%M:%S')\r\n            utc_time = utc_time.replace(tzinfo=timezone.utc)\r\n            la_time = utc_time.astimezone(self.la_tz)\r\n            \r\n            # \u66f4\u65b0\u7edf\u8ba1\u6570\u636e\r\n            self.ip_stats[ip]['count'] += 1\r\n            self.ip_stats[ip]['bytes'] += bytes_sent\r\n            self.ip_stats[ip]['status_codes'][status] += 1\r\n            self.hourly_traffic[la_time.hour] += 1\r\n            self.response_times.append(response_time)\r\n    \r\n    def generate_report(self):\r\n        print(\"\u6d1b\u6749\u77f6\u670d\u52a1\u5668\u5206\u6790\u62a5\u544a\")\r\n        print(\"=\" * 50)\r\n        \r\n        print(\"\\n\u6309\u6d41\u91cf\u6392\u540d\u524d5\u7684IP\u5730\u5740\uff1a\")\r\n        sorted_ips = sorted(self.ip_stats.items(), \r\n                          key=lambda x: x[1]['bytes'], \r\n                          reverse=True)[:5]\r\n        for ip, stats in sorted_ips:\r\n            print(f\"{ip}: {stats['bytes']\/1024\/1024:.2f} MB\")\r\n        \r\n        print(\"\\n\u6bcf\u5c0f\u65f6\u6d41\u91cf\u5206\u5e03\uff08\u6d1b\u6749\u77f6\u65f6\u95f4\uff09\uff1a\")\r\n        for hour in sorted(self.hourly_traffic.keys()):\r\n            print(f\"{hour:02d}:00 - {self.hourly_traffic[hour]} \u4e2a\u8bf7\u6c42\")\r\n        \r\n        if self.response_times:\r\n            avg_response = sum(self.response_times)\/len(self.response_times)\r\n            print(f\"\\n\u5e73\u5747\u54cd\u5e94\u65f6\u95f4\uff1a{avg_response:.3f} \u79d2\")\r\n\r\n# \u4f7f\u7528\u793a\u4f8b\r\nanalyzer = LAServerAnalyzer()\r\nwith open('access.log', 'r') as f:\r\n    for line in f:\r\n        analyzer.analyze_line(line)\r\nanalyzer.generate_report()\r\n<\/code><\/pre>\n
\u7ed3\u8bba\u548c\u6700\u4f73\u5b9e\u8df5<\/strong><\/h2>\n
\u6709\u6548\u7684\u65e5\u5fd7\u5206\u6790\u548c\u6d41\u91cf\u76d1\u63a7\u662f\u7ef4\u6301\u6d1b\u6749\u77f6\u670d\u52a1\u5668\u79df\u7528\u73af\u5883\u6700\u4f73\u6027\u80fd\u7684\u57fa\u7840\u3002\u6d1b\u6749\u77f6\u7279\u5b9a\u73af\u5883\u7684\u5173\u952e\u8003\u8651\u56e0\u7d20\u5305\u62ec\uff1a<\/p>\n
\n
\u4e3a\u592a\u5e73\u6d0b\u6cbf\u5cb8\u6d41\u91cf\u6a21\u5f0f\u914d\u7f6e\u76d1\u63a7\u5de5\u5177<\/li>\n
\u4e3a\u9ad8\u4ef7\u503c\u5a31\u4e50\u884c\u4e1a\u76ee\u6807\u5b9e\u65bd\u5f3a\u5927\u7684DDoS\u4fdd\u62a4<\/li>\n
\u9488\u5bf9\u6d1b\u6749\u77f6\u6570\u636e\u4e2d\u5fc3\u5e38\u89c1\u7684\u5a92\u4f53\u5bc6\u96c6\u578b\u5de5\u4f5c\u8d1f\u8f7d\u8fdb\u884c\u4f18\u5316<\/li>\n
\u76d1\u63a7\u8de8\u592a\u5e73\u6d0b\u5ef6\u8fdf\u548c\u8fde\u63a5\u8d28\u91cf<\/li>\n
\u7ef4\u62a4\u5e26\u5730\u7406\u4f4d\u7f6e\u4e0a\u4e0b\u6587\u7684\u7efc\u5408\u5b89\u5168\u65e5\u5fd7<\/li>\n
\u4f7f\u7528\u53ef\u89c6\u5316\u5de5\u5177\u8fdb\u884c\u5b9e\u65f6\u6d41\u91cf\u5206\u6790<\/li>\n
\u4f7f\u7528\u6700\u65b0\u7684\u5b89\u5168\u8865\u4e01\u4fdd\u6301\u76d1\u63a7\u7cfb\u7edf\u66f4\u65b0<\/li>\n<\/ul>\n
\n
\u6d1b\u6749\u77f6\u670d\u52a1\u5668\u76d1\u63a7\u6700\u7ec8\u68c0\u67e5\u6e05\u5355\uff1a<\/strong><\/p>\n
\n
\u2713 \u5b9e\u65bd24\/7\u81ea\u52a8\u76d1\u63a7\u7cfb\u7edf<\/li>\n
\u2713 \u914d\u7f6e\u5f02\u5e38\u6d41\u91cf\u6a21\u5f0f\u8b66\u62a5<\/li>\n
\u2713 \u8bbe\u7f6e\u56fd\u9645\u6d41\u91cf\u5e26\u5bbd\u76d1\u63a7<\/li>\n
\u2713 \u542f\u7528\u5b89\u5168\u4e8b\u4ef6\u8be6\u7ec6\u65e5\u5fd7\u8bb0\u5f55<\/li>\n
\u2713 \u5b9a\u671f\u5907\u4efd\u65e5\u5fd7\u6587\u4ef6<\/li>\n
\u2713 \u7ef4\u62a4\u66f4\u65b0\u7684\u5b89\u5168\u7b56\u7565<\/li>\n
\u2713 \u5b9a\u671f\u7cfb\u7edf\u6027\u80fd\u5ba1\u8ba1<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
\u670d\u52a1\u5668\u65e5\u5fd7\u5206\u6790\u662f\u6d1b\u6749\u77f6\u670d\u52a1\u5668\u79df\u7528\u548c\u670d\u52a1\u5668\u6258\u7ba1\u670d\u52a1\u9ad8\u6548\u8fd0\u884c\u7684\u57fa\u7840\u3002\u65e0\u8bba\u60a8\u662f\u5728\u7ba1\u7406\u9ad8\u6d41\u91cf\u7684\u7535\u5b50\u5546\u52a1\u5e73\u53f0\u8fd8\u662f\u7ef4\u62a4\u5173\u952e\u4e1a\u52a1\u5e94\u7528\u7a0b\u5e8f\uff0c\u4e86\u89e3\u670d\u52a1\u5668\u7684\u7f51\u7edc\u6a21\u5f0f\u5bf9\u4e8e\u6700\u4f73\u6027\u80fd\u81f3\u5173\u91cd\u8981\u3002\u672c\u6307\u5357\u6df1\u5165\u63a2\u8ba8\u4e86\u5206\u6790\u670d\u52a1\u5668\u65e5\u5fd7\u548c\u7f51\u7edc\u6d41\u91cf\u7684\u4e13\u4e1a\u6280\u672f\uff0c\u4e13\u95e8\u9488\u5bf9\u6d1b\u6749\u77f6\u6570\u636e\u4e2d\u5fc3\u8fdb\u884c\u4e86\u8c03\u6574\u3002 \u6d1b\u6749\u77f6\u7f51\u7edc\u6d41\u91cf\u7279\u70b9 \u6d1b\u6749\u77f6\u4f5c\u4e3a\u592a\u5e73\u6d0b\u6cbf\u5cb8\u4e3b\u8981\u79d1\u6280\u4e2d\u5fc3\u7684\u72ec\u7279\u5730\u4f4d\u9020\u5c31\u4e86\u5176\u7279\u6709\u7684\u6d41\u91cf\u6a21\u5f0f\u548c\u6311\u6218\uff1a \u8de8\u592a\u5e73\u6d0b\u6d41\u91cf\u5728\u4e9a\u6d32\u5de5\u4f5c\u65f6\u95f4\u8fbe\u5230\u5cf0\u503c\uff08\u592a\u5e73\u6d0b\u6807\u51c6\u65f6\u95f417:00-01:00\uff09 \u5a31\u4e50\u884c\u4e1a\u6570\u636e\u4f20\u8f93\u4ea7\u751f\u5b9a\u671f\u7684\u5927\u5bb9\u91cf\u7a81\u53d1 \u91d1\u878d\u533a\u57df\u8fd0\u8425\u4ea7\u751f\u7684\u9ad8\u9891\u4ea4\u6613\u6d41\u91cf \u6765\u81ea\u6d41\u5a92\u4f53\u670d\u52a1\u548c\u6e38\u620f\u5e73\u53f0\u7684\u5185\u5bb9\u5206\u53d1\u9700\u6c42 \u7406\u89e3\u7f51\u7edc\u6d41\u91cf\u57fa\u7840 \u7f51\u7edc\u6d41\u91cf\u5206\u6790\u6d89\u53ca\u68c0\u67e5\u6d41\u7ecf\u670d\u52a1\u5668\u7684\u6570\u636e\u5305\u3002\u5728\u6d1b\u6749\u77f6\u6570\u636e\u4e2d\u5fc3\uff0c\u8fde\u63a5\u9009\u9879\u4ece1Gbps\u5230100Gbps\u4e0d\u7b49\uff0c\u4e86\u89e3\u6d41\u91cf\u6a21\u5f0f\u5bf9\u4e8e\u5bb9\u91cf\u89c4\u5212\u548c\u6545\u969c\u6392\u9664\u81f3\u5173\u91cd\u8981\u3002 \u57fa\u672c\u6d41\u91cf\u76d1\u63a7\u547d\u4ee4\uff1a # \u663e\u793a\u5f53\u524d\u7f51\u7edc\u8fde\u63a5\u548c\u8def\u7531\u8868 netstat -r # \u76d1\u63a7\u7f51\u7edc\u63a5\u53e3\u7edf\u8ba1 netstat -i # \u67e5\u770b\u6240\u6709\u6d3b\u52a8\u8fde\u63a5 netstat -antup # \u76d1\u63a7\u5b9e\u65f6\u5e26\u5bbd\u4f7f\u7528\u60c5\u51b5 iftop -i eth0 # \u8ddf\u8e2aTCP\u8fde\u63a5\u72b6\u6001 ss -tan state established \u9ad8\u7ea7\u65e5\u5fd7\u5206\u6790\u5de5\u5177 \u73b0\u4ee3\u670d\u52a1\u5668\u7ba1\u7406\u9700\u8981\u590d\u6742\u7684\u5de5\u5177\u8fdb\u884c\u5168\u9762\u7684\u65e5\u5fd7\u5206\u6790\u3002\u4ee5\u4e0b\u662f\u4e13\u95e8\u4e3a\u6d1b\u6749\u77f6\u9ad8\u6d41\u91cf\u73af\u5883\u914d\u7f6e\u7684\u884c\u4e1a\u6807\u51c6\u89e3\u51b3\u65b9\u6848\uff1a tcpdump\uff1a\u7528\u4e8e\u5e26\u81ea\u5b9a\u4e49\u8fc7\u6ee4\u5668\u7684\u6570\u636e\u5305\u7ea7\u5206\u6790 Wireshark\uff1a\u7528\u4e8e\u8be6\u7ec6\u7684\u534f\u8bae\u5206\u6790\u548c\u6d41\u91cf\u68c0\u67e5 AWStats\uff1a\u7528\u4e8e\u5168\u9762\u7684\u7f51\u7edc\u7edf\u8ba1\u548c\u8bbf\u5ba2\u5206\u6790 ELK Stack\uff1a\u7528\u4e8e\u96c6\u4e2d\u5f0f\u65e5\u5fd7\u7ba1\u7406\u548c\u53ef\u89c6\u5316 Grafana\uff1a\u7528\u4e8e\u5b9e\u65f6\u6307\u6807\u53ef\u89c6\u5316 Prometheus\uff1a\u7528\u4e8e\u6307\u6807\u6536\u96c6\u548c\u8b66\u62a5 # \u4f7f\u7528\u8be6\u7ec6\u65f6\u95f4\u6355\u83b7HTTP\u6d41\u91cf tcpdump -i any -w capture.pcap ‘port 80 or port 443’ -ttt […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":3,"featured_media":21859,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4816],"tags":[6152,6149,6150,6151,3446],"class_list":["post-21865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-america-dedicated-server-sc","tag-traffic-anomaly-detection-sc","tag-los-angeles-server-analysis-sc","tag-network-traffic-monitoring-sc","tag-server-log-analysis-sc","tag-bandwidth-optimization-sc"],"acf":[],"yoast_head":"\n