Anti-Syn-Flood

#!/bin/bash

while [ true ]
do
  BL=`iptables -L -n`
  LISTE_IPS=`netstat -tanpu | awk '/SYN_RECV/ {print $5}' | cut -f1 -d':' | sort | uniq -c | awk '{if ($1 > 2) {print $2}}'`
  if [ ! -z "$LISTE_IPS" ]
  then
    echo "$LISTE_IPS" | while read IP
    do
      echo "$BL" | grep "$IP" > /dev/null 2>&1
      if [ $? -ne 0 ]
      then
        iptables -A INPUT -s $IP/24 -j DROP
        echo "`date` - $IP bloquee"
      fi
    done
    /etc/init.d/httpd stop > /dev/null 2>&1
    sleep 5
    /etc/init.d/httpd start > /dev/null 2>&1
  fi
  sleep 2
done