Code:
#!/bin/sh
netstat -an | grep "server_ip:80" | grep SYN_RECV | awk '{print $5}' | cut -d: -f1 | sort | uniq | xargs -n 1 -I '{}' apf -d '{}'
How to use it ?
pico ddos.sh
Paste this script CRTL +x y
chmod 777 ddos.sh
And run
./ddos.sh
This script will put all SYN_FLOOD ip's to APF firewall deny list.