Script to email admin in the event of an attack
I'm using a Script that would automatically do a dump of the attack as
soon as it exceeds a threshold. The scripts looks like the following:
interface=eth0
dumpdir=/tmp/
while /bin/true; do
pkt_old=`grep $interface: /proc/net/dev | cut -d : -f2 | awk '{ print
$2 }'`
sleep 1
pkt_new=`grep $interface: /proc/net/dev | cut -d : -f2 | awk '{ print
$2 }'`
pkt=$(( $pkt_new - $pkt_old ))
echo -ne "\r$pkt packets/s\033[0K"
if [ $pkt -gt 10000 ]; then
echo -e "\n`date` Under attack, dumping packets."
tcpdump -nn -s0 -c 2000 -w $dumpdir/dump.`date +"%Y%m%d-%H%M%S"`.cap
echo "`date` Packets dumped, sleeping now."
sleep 300
fi
done
I want the same Script to send an Email to a specified address to notify
the Admin if the server was attacked. How should we achieve this?
No comments:
Post a Comment