TCP连接数统计脚本

• 脚本名称：count_connection.sh

• 执行结果如下：

  [root@test ]# bash count_connection.sh 
  ip:10.0.0.99
  连接数:228
  服务状态:ESTABLISHED,FIN_WAIT2,TIME_WAIT,CLOSE_WAIT
  服务:java,-
  

• 飞书通知如下

  

• 完整脚本

  #!/bin/bash
  # 如有预警高连接IP，需先查询nginx服务器日志，确定是否为异常IP，再执行以下iptables命令禁用异常IP
  # iptables规则禁用高连接的异常IP: iptables -I INPUT -s <被禁IP> -j DROP# 定义飞书机器人的Webhook URL   
  feishu_hook='https://open.feishu.cn/open-apis/bot/v2/hook/xxxx'# 内网IP
  inet_ip=$(ip a| grep eth0 | grep inet |grep -v inet6|awk '{print $2}'|awk -F '/' '{print $1}')# 生成数组声明语句并执行
  eval "$(netstat -antpl | gawk -v target="$inet_ip" '
  BEGIN {count = 0PROCINFO["sorted_in"] = "@val_num_desc"
  }
  $0 ~ target {split($5, arr, /:[0-9]+$/)ip = arr[1]cnt[ip]++total++if (!seen_state[ip][$6]++)states[ip] = (states[ip] ? states[ip] "," : "") $6split($7, p, "/")svc = p[2] ? p[2] : p[1]if (!seen_svc[ip][svc]++)services[ip] = (services[ip] ? services[ip] "," : "") svc
  }
  END {for (ip in cnt) {if (count >= 1) breakcount++# 转义单引号防止语法错误gsub(/\047/, "\047\\\047\047", states[ip])  # 处理单引号gsub(/\047/, "\047\\\047\047", services[ip])# 生成关联数组声明语句printf "declare -A ip_arr=(\n"printf "  [\"ip_addr\"]=\"%s\"\n", ipprintf "  [\"connection_count\"]=%d\n", cnt[ip]printf "  [\"states\"]=\"%s\"\n", states[ip]printf "  [\"services\"]=\"%s\"\n", services[ip]printf ")\n"}
  }')"# 验证结果
  if declare -p ip_arr &> /dev/null; thenecho "IP地址：${ip_arr["ip_addr"]}"echo "连接数：${ip_arr["connection_count"]}"echo "状态列表：${ip_arr["states"]}"echo "服务列表：${ip_arr["services"]}"
  elseecho "未找到匹配的连接"
  fijson_data=$(cat <<EOF
  {"msg_type": "text","content": {"text": "********** TCP连接警告 **********\\n\\nIP地址:\\n${ip_arr['ip_addr']}\\n\\n连接数:\\n${ip_arr['connection_count']}\\n\\n服务状态:\\n${ip_arr['states']}\\n服务:\\n${ip_arr['services']}"}
  }
  EOF
  )# if [ ${ip_arr["connection_count"]} -ge 500 ];then
  #     #echo "${ip_arr["connection_count"]}，大于 500"
  #     curl -X POST -H "Content-Type: application/json" \
  #              -d '{"msg_type":"text","content":{"text":"Foreign_ip:'''${ip_arr["ip_addr"]}\\n'''连接数:'''${ip_arr["connection_count"]}\\n'''服务状态:'''${ip_arr["states"]}\\n'''服务:'''${ip_arr["services"]}\\n'''"}}' \
  #              https://open.feishu.cn/open-apis/bot/v2/hook/xxxx
  # fi# 判断连接数是否大于500
  if [ ${ip_arr["connection_count"]} -ge 500 ];then# 发送请求到飞书curl -X POST -H "Content-Type: application/json" -d "$json_data" "$feishu_hook"
  elseecho "连接数小于500，不发送飞书通知"
  fi