#!/usr/bin/env bash

# $1 client_ip_as_string
# $2 data_direction
# $3 pps_as_string
# $4 action (ban or unban)

email_notify="ваша_почта"
time="`date '+%m-%d_%H:%M'`"
# Далее возможны два варианта:
# это первый запуск, при котором нужно банить IP (на stdin пусто)
# это второй запуск, когда скрипт уже собрал (если смог) детали об атаке (на stdin даные об атаке)

if [ "$4" = "unban" ]; then
    # Unban actions if used
    exit 0
fi

if [ "$4" = "ban" ]; then
#    cat | mail -s "FastNetMon Guard: IP $1 blocked because $2 attack with power $3 pps" $email_notify;
    # You can add ban code here!
    # iptables -A INPUT -s $1 -j DROP
    # iptables -A INPUT -d $1 -j DROP
/usr/sbin/tcpdump -v -n -c 300 >> /root/attack_$time.log
/usr/sbin/tcpdump -v -x -n -w /root/ddos_$time.log -c 300
    exit 0
fi

if [ "$4" == "attack_details" ]; then
    cat | mail -s "FastNetMon Guard: IP $1 blocked because $2 attack with power $3 pps" $email_notify;
fi

2015-07-05 15:23:47,339  [INFO]We use custom sampling ratio for netflow: 1
2015-07-05 15:23:47,339  [INFO]netflow plugin will listen on 0.0.0.0:2055 udp port
2015-07-05 15:23:47,339  [INFO]sflow plugin started
2015-07-05 15:23:47,339  [INFO]sflow plugin will listen on 0.0.0.0:6343 udp port
2015-07-05 15:23:47,339  [INFO]PF_RING plugin started
2015-07-05 15:23:47,339  [INFO]We selected interface:eth0
2015-07-05 15:23:47,341  [INFO]Successully binded to: eth0
2015-07-05 15:23:47,341  [INFO]Device RX channels number:
2015-07-05 15:23:47,341  [INFO]Using PF_RING v.6.0.3
2015-07-05 15:23:47,341  [INFO]Run banlist cleanup thread