\r\n# \u4f7f\u7528\u8a73\u7d30\u6642\u9593\u6355\u7372HTTP\u6d41\u91cf\r\ntcpdump -i any -w capture.pcap 'port 80 or port 443' -ttt\r\n\r\n# \u5206\u6790\u7279\u5b9a\u5b50\u7db2\u6d41\u91cf\r\ntcpdump net 192.168.1.0\/24\r\n\r\n# \u76e3\u63a7\u7279\u5b9a\u61c9\u7528\u7a0b\u5f0f\u6d41\u91cf\r\ntcpdump port 3306 -vv\r\n<\/code><\/pre>\n
\u5be6\u73fe\u5373\u6642\u76e3\u63a7\u7cfb\u7d71<\/strong><\/h2>\n
\r\n#!\/bin\/bash\r\n\r\n# \u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u9032\u968e\u76e3\u63a7\u8173\u672c\r\nLOG_FILE=\"\/var\/log\/nginx\/access.log\"\r\nALERT_THRESHOLD=1000\r\nEMAIL=\"admin@example.com\"\r\n\r\nmonitor_traffic() {\r\n    while true; do\r\n        CONNECTIONS=$(netstat -an | grep ESTABLISHED | wc -l)\r\n        MEMORY_USAGE=$(free -m | awk 'NR==2{printf \"%.2f%%\", $3*100\/$2}')\r\n        \r\n        if [ $CONNECTIONS -gt $ALERT_THRESHOLD ]; then\r\n            echo \"\u9ad8\u6d41\u91cf\u8b66\u5831\uff1a$CONNECTIONS \u500b\u6d3b\u52d5\u9023\u63a5\" | \\\r\n            mail -s \"\u6d41\u91cf\u8b66\u5831\" $EMAIL\r\n        fi\r\n        \r\n        echo \"$(date): \u9023\u63a5\u6578=$CONNECTIONS, \u8a18\u61b6\u9ad4=$MEMORY_USAGE\"\r\n        sleep 60\r\n    done\r\n}\r\n\r\nmonitor_traffic &\r\n<\/code><\/pre>\n
\u6d1b\u6749\u78ef\u5c16\u5cf0\u6642\u6bb5\u6d41\u91cf\u6a21\u5f0f\u5206\u6790<\/strong><\/h2>\n
\u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u7d93\u6b77\u7368\u7279\u7684\u6d41\u91cf\u6a21\u5f0f\uff0c\u539f\u56e0\u5982\u4e0b\uff1a<\/p>\n
\n
\u5a1b\u6a02\u696d\u6e32\u67d3\u8fb2\u5834\u904b\u71df\uff08\u901a\u5e38\u592a\u5e73\u6d0b\u6a19\u6e96\u6642\u959318:00-06:00\uff09<\/li>\n
\u4e9e\u6d32\u5e02\u5834\u4ea4\u6613\u6642\u9593\uff08\u592a\u5e73\u6d0b\u6a19\u6e96\u6642\u959317:00-01:00\uff09<\/li>\n
\u6b50\u6d32\u5e02\u5834\u958b\u76e4\u91cd\u758a\u6642\u9593\uff08\u592a\u5e73\u6d0b\u6a19\u6e96\u6642\u959323:00-02:00\uff09<\/li>\n
\u672c\u5730\u696d\u52d9\u5c16\u5cf0\u6642\u9593\uff08\u592a\u5e73\u6d0b\u6a19\u6e96\u6642\u959309:00-17:00\uff09<\/li>\n<\/ul>\n
\r\nimport pandas as pd\r\nimport matplotlib.pyplot as plt\r\nfrom datetime import datetime\r\n\r\ndef analyze_la_traffic(log_file):\r\n    # \u8b80\u53d6\u5e36\u6642\u5340\u610f\u8b58\u7684\u65e5\u8a8c\u6a94\u6848\r\n    df = pd.read_csv(log_file, \r\n                     parse_dates=['timestamp'],\r\n                     date_parser=lambda x: pd.to_datetime(x, utc=True))\r\n    \r\n    # \u8f49\u63db\u70ba\u6d1b\u6749\u78ef\u6642\u9593\r\n    df['local_time'] = df['timestamp'].dt.tz_convert('America\/Los_Angeles')\r\n    df['hour'] = df['local_time'].dt.hour\r\n    \r\n    # \u5206\u6790\u6bcf\u5c0f\u6642\u6a21\u5f0f\r\n    hourly_traffic = df.groupby('hour').size()\r\n    \r\n    # \u8b58\u5225\u5c16\u5cf0\u6642\u6bb5\r\n    peak_hours = hourly_traffic[hourly_traffic > hourly_traffic.mean() + hourly_traffic.std()]\r\n    \r\n    return hourly_traffic, peak_hours\r\n\r\n# \u4f7f\u7528\u793a\u4f8b\r\ntraffic_data, peaks = analyze_la_traffic('access.log')\r\n<\/code><\/pre>\n
\u6d1b\u6749\u78ef\u8cc7\u6599\u4e2d\u5fc3\u589e\u5f37\u5b89\u5168\u76e3\u63a7<\/strong><\/h2>\n
\u7531\u65bc\u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u662f\u9ad8\u50f9\u503c\u76ee\u6a19\uff0c\u9700\u8981\u5f37\u5927\u7684\u5b89\u5168\u76e3\u63a7\u3002\u5be6\u65bd\u4ee5\u4e0b\u9032\u968e\u5b89\u5168\u63aa\u65bd\uff1a<\/p>\n
\r\n#!\/bin\/bash\r\n\r\n# \u9032\u968e\u5b89\u5168\u76e3\u63a7\u8173\u672c\r\nLOG_DIR=\"\/var\/log\"\r\nTHRESHOLD=100\r\nBLOCK_TIME=3600\r\n\r\nmonitor_security() {\r\n    # \u76e3\u63a7\u591a\u500b\u653b\u64ca\u5411\u91cf\r\n    tail -f $LOG_DIR\/auth.log $LOG_DIR\/nginx\/access.log | \\\r\n    grep -E \"Failed password|POST \/wp-login|SELECT FROM|\/phpMyAdmin\" | \\\r\n    while read line; do\r\n        IP=$(echo $line | grep -oE \"\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b\")\r\n        if [ ! -z \"$IP\" ]; then\r\n            COUNT=$(grep \"$IP\" $LOG_DIR\/auth.log | wc -l)\r\n            if [ $COUNT -gt $THRESHOLD ]; then\r\n                iptables -A INPUT -s $IP -j DROP\r\n                echo \"$(date): \u5df2\u5c01\u9396 $IP\uff0c\u539f\u56e0\uff1a\u53ef\u7591\u6d3b\u52d5\"\r\n                # \u8a08\u5283\u89e3\u9664\u5c01\u9396\r\n                at now + $BLOCK_TIME seconds << EOF\r\n                iptables -D INPUT -s $IP -j DROP\r\nEOF\r\n            fi\r\n        fi\r\n    done\r\n}\r\n\r\nmonitor_security &\r\n<\/code><\/pre>\n
\u5a92\u9ad4\u5bc6\u96c6\u578b\u6d41\u91cf\u7684\u983b\u5bec\u6700\u4f73\u5316<\/strong><\/h2>\n
\u70ba\u6d1b\u6749\u78ef\u7684\u5a92\u9ad4\u5bc6\u96c6\u578b\u74b0\u5883\u6700\u4f73\u5316\u983b\u5bec\u4f7f\u7528\uff1a<\/p>\n
\r\n# Nginx\u5a92\u9ad4\u6700\u4f73\u5316\u8a2d\u5b9a\r\nhttp {\r\n    # \u9032\u968e\u58d3\u7e2e\u8a2d\u5b9a\r\n    gzip on;\r\n    gzip_vary on;\r\n    gzip_min_length 1000;\r\n    gzip_proxied expired no-cache no-store private auth;\r\n    gzip_types text\/plain text\/css application\/json application\/javascript application\/x-javascript text\/xml application\/xml application\/xml+rss text\/javascript image\/svg+xml;\r\n    gzip_comp_level 6;\r\n\r\n    # \u700f\u89bd\u5668\u5feb\u53d6\r\n    map $sent_http_content_type $expires {\r\n        default                    off;\r\n        text\/html                  epoch;\r\n        text\/css                   max;\r\n        application\/javascript     max;\r\n        ~image\/                    max;\r\n        ~video\/                    30d;\r\n        ~audio\/                    30d;\r\n    }\r\n\r\n    server {\r\n        location ~* \\.(jpg|jpeg|png|gif|ico|css|js|mp4)$ {\r\n            expires $expires;\r\n            add_header Cache-Control \"public, no-transform\";\r\n            add_header X-Frame-Options \"SAMEORIGIN\";\r\n            add_header X-XSS-Protection \"1; mode=block\";\r\n        }\r\n        \r\n        # \u5a92\u9ad4\u4e32\u6d41\u6700\u4f73\u5316\r\n        location \/videos\/ {\r\n            mp4;\r\n            mp4_buffer_size 1m;\r\n            mp4_max_buffer_size 5m;\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\n
\u81ea\u52d5\u6548\u80fd\u5206\u6790<\/strong><\/h2>\n
\r\nimport sys\r\nimport re\r\nfrom collections import defaultdict\r\nfrom datetime import datetime, timezone\r\nimport pytz\r\n\r\nclass LAServerAnalyzer:\r\n    def __init__(self):\r\n        self.ip_stats = defaultdict(lambda: {\r\n            'count': 0,\r\n            'bytes': 0,\r\n            'status_codes': defaultdict(int)\r\n        })\r\n        self.hourly_traffic = defaultdict(int)\r\n        self.response_times = []\r\n        self.la_tz = pytz.timezone('America\/Los_Angeles')\r\n    \r\n    def analyze_line(self, line):\r\n        patterns = {\r\n            'ip': r'(\\d+\\.\\d+\\.\\d+\\.\\d+)',\r\n            'time': r'\\[(\\d+\/\\w+\/\\d+:\\d+:\\d+:\\d+)',\r\n            'status': r'\" (\\d{3}) ',\r\n            'bytes': r'\" \\d{3} (\\d+)',\r\n            'response_time': r'\" \\d{3} \\d+ \"(\\d+\\.\\d+)\"'\r\n        }\r\n        \r\n        matches = {k: re.search(v, line) for k, v in patterns.items()}\r\n        \r\n        if all(matches.values()):\r\n            ip = matches['ip'].group(1)\r\n            time_str = matches['time'].group(1)\r\n            status = matches['status'].group(1)\r\n            bytes_sent = int(matches['bytes'].group(1))\r\n            response_time = float(matches['response_time'].group(1))\r\n            \r\n            # \u8f49\u63db\u70ba\u6d1b\u6749\u78ef\u6642\u9593\r\n            utc_time = datetime.strptime(time_str, '%d\/%b\/%Y:%H:%M:%S')\r\n            utc_time = utc_time.replace(tzinfo=timezone.utc)\r\n            la_time = utc_time.astimezone(self.la_tz)\r\n            \r\n            # \u66f4\u65b0\u7d71\u8a08\u8cc7\u6599\r\n            self.ip_stats[ip]['count'] += 1\r\n            self.ip_stats[ip]['bytes'] += bytes_sent\r\n            self.ip_stats[ip]['status_codes'][status] += 1\r\n            self.hourly_traffic[la_time.hour] += 1\r\n            self.response_times.append(response_time)\r\n    \r\n    def generate_report(self):\r\n        print(\"\u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u5206\u6790\u5831\u544a\")\r\n        print(\"=\" * 50)\r\n        \r\n        print(\"\\n\u6309\u6d41\u91cf\u6392\u540d\u524d5\u7684IP\u5730\u5740\uff1a\")\r\n        sorted_ips = sorted(self.ip_stats.items(), \r\n                          key=lambda x: x[1]['bytes'], \r\n                          reverse=True)[:5]\r\n        for ip, stats in sorted_ips:\r\n            print(f\"{ip}: {stats['bytes']\/1024\/1024:.2f} MB\")\r\n        \r\n        print(\"\\n\u6bcf\u5c0f\u6642\u6d41\u91cf\u5206\u5e03\uff08\u6d1b\u6749\u78ef\u6642\u9593\uff09\uff1a\")\r\n        for hour in sorted(self.hourly_traffic.keys()):\r\n            print(f\"{hour:02d}:00 - {self.hourly_traffic[hour]} \u500b\u8acb\u6c42\")\r\n        \r\n        if self.response_times:\r\n            avg_response = sum(self.response_times)\/len(self.response_times)\r\n            print(f\"\\n\u5e73\u5747\u56de\u61c9\u6642\u9593\uff1a{avg_response:.3f} \u79d2\")\r\n\r\n# \u4f7f\u7528\u793a\u4f8b\r\nanalyzer = LAServerAnalyzer()\r\nwith open('access.log', 'r') as f:\r\n    for line in f:\r\n        analyzer.analyze_line(line)\r\nanalyzer.generate_report()\r\n<\/code><\/pre>\n
\u7d50\u8ad6\u548c\u6700\u4f73\u5be6\u52d9<\/strong><\/h2>\n
\u6709\u6548\u7684\u65e5\u8a8c\u5206\u6790\u548c\u6d41\u91cf\u76e3\u63a7\u662f\u7dad\u6301\u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u6700\u4f73\u6548\u80fd\u7684\u57fa\u790e\u3002\u6d1b\u6749\u78ef\u7279\u5b9a\u74b0\u5883\u7684\u95dc\u9375\u8003\u616e\u56e0\u7d20\u5305\u62ec\uff1a<\/p>\n
\n
\u70ba\u592a\u5e73\u6d0b\u6cbf\u5cb8\u6d41\u91cf\u6a21\u5f0f\u914d\u7f6e\u76e3\u63a7\u5de5\u5177<\/li>\n
\u70ba\u9ad8\u50f9\u503c\u5a1b\u6a02\u7522\u696d\u76ee\u6a19\u5be6\u65bd\u5f37\u5927\u7684DDoS\u9632\u8b77<\/li>\n
\u91dd\u5c0d\u6d1b\u6749\u78ef\u8cc7\u6599\u4e2d\u5fc3\u5e38\u898b\u7684\u5a92\u9ad4\u5bc6\u96c6\u578b\u5de5\u4f5c\u8ca0\u8f09\u9032\u884c\u6700\u4f73\u5316<\/li>\n
\u76e3\u63a7\u8de8\u592a\u5e73\u6d0b\u5ef6\u9072\u548c\u9023\u63a5\u54c1\u8cea<\/li>\n
\u7dad\u8b77\u5e36\u5730\u7406\u4f4d\u7f6e\u4e0a\u4e0b\u6587\u7684\u7d9c\u5408\u5b89\u5168\u65e5\u8a8c<\/li>\n
\u4f7f\u7528\u8996\u89ba\u5316\u5de5\u5177\u9032\u884c\u5373\u6642\u6d41\u91cf\u5206\u6790<\/li>\n
\u4f7f\u7528\u6700\u65b0\u7684\u5b89\u5168\u88dc\u4e01\u4fdd\u6301\u76e3\u63a7\u7cfb\u7d71\u66f4\u65b0<\/li>\n<\/ul>\n
\n
\u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u76e3\u63a7\u6700\u7d42\u6aa2\u67e5\u6e05\u55ae\uff1a<\/strong><\/p>\n
\n
\u2713 \u5be6\u65bd24\/7\u81ea\u52d5\u76e3\u63a7\u7cfb\u7d71<\/li>\n
\u2713 \u914d\u7f6e\u7570\u5e38\u6d41\u91cf\u6a21\u5f0f\u8b66\u5831<\/li>\n
\u2713 \u8a2d\u7f6e\u570b\u969b\u6d41\u91cf\u983b\u5bec\u76e3\u63a7<\/li>\n
\u2713 \u555f\u7528\u5b89\u5168\u4e8b\u4ef6\u8a73\u7d30\u65e5\u8a8c\u8a18\u9304<\/li>\n
\u2713 \u5b9a\u671f\u5099\u4efd\u65e5\u8a8c\u6a94\u6848<\/li>\n
\u2713 \u7dad\u8b77\u66f4\u65b0\u7684\u5b89\u5168\u7b56\u7565<\/li>\n
\u2713 \u5b9a\u671f\u7cfb\u7d71\u6548\u80fd\u7a3d\u6838<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
\u4f3a\u670d\u5668\u65e5\u8a8c\u5206\u6790\u662f\u6d1b\u6749\u78ef\u4f3a\u670d\u5668\u79df\u7528\u548c\u4f3a\u670d\u5668\u8a17\u7ba1\u670d\u52d9\u9ad8\u6548\u904b\u884c\u7684\u57fa\u790e\u3002\u7121\u8ad6\u60a8\u662f\u5728\u7ba1\u7406\u9ad8\u6d41\u91cf\u7684\u96fb\u5b50\u5546\u52d9\u5e73\u53f0\u9084\u662f\u7dad\u8b77\u95dc\u9375 […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":3,"featured_media":21858,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4815],"tags":[6147,6145,6148,6146,3443],"class_list":["post-21864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-america-dedicated-server-tc","tag-server-log-analysis-tc","tag-los-angeles-server-analysis-tc","tag-traffic-anomaly-detection-tc","tag-network-traffic-monitoring-tc","tag-bandwidth-optimization-tc"],"acf":[],"yoast_head":"\n