Collection of Linux Scripts for firewall, security, alerts, monitoring, etc…

1. check_syn_flood.rb

Will check if there are more than 40 SYN_REC TCP streams from the same IP.

Then it will block with iptables, inserting at top of chain the offending IP. such as:

/sbin/iptables -I INPUT -s 123.1.1.1 -j DROP

Works on Linux and OSX