TCP连接数统计脚本

• 脚本名称：count_connection.sh

• 执行结果如下：

  [root@test ]# bash count_connection.sh 
  ip:10.0.0.99
  连接数:228
  服务状态:ESTABLISHED,FIN_WAIT2,TIME_WAIT,CLOSE_WAIT
  服务:java,-
  

• 飞书通知如下

  

• 完整脚本

  #!/bin/bash
  # 如有预警高连接IP，需先查询nginx服务器日志，确定是否为异常IP，再执行以下iptables命令禁用异常IP
  # iptables规则禁用高连接的异常IP: iptables -I INPUT -s <被禁IP> -j DROP
  
  # 定义飞书机器人的Webhook URL   
  feishu_hook='https://open.feishu.cn/open-apis/bot/v2/hook/xxxx'
  
  # 内网IP
  inet_ip=$(ip a| grep eth0 | grep inet |grep -v inet6|awk '{print $2}'|awk -F '/' '{print $1}')
  
  # 生成数组声明语句并执行
  eval "$(netstat -antpl | gawk -v target="$inet_ip" '
  BEGIN {
      count = 0
      PROCINFO["sorted_in"] = "@val_num_desc"
  }
  $0 ~ target {
      split($5, arr, /:[0-9]+$/)
      ip = arr[1]
  
      cnt[ip]++
      total++
  
      if (!seen_state[ip][$6]++)
          states[ip] = (states[ip] ? states[ip] "," : "") $6
  
      split($7, p, "/")
      svc = p[2] ? p[2] : p[1]
      if (!seen_svc[ip][svc]++)
          services[ip] = (services[ip] ? services[ip] "," : "") svc
  }
  END {
      for (ip in cnt) {
          if (count >= 1) break
          count++
  
          # 转义单引号防止语法错误
          gsub(/\047/, "\047\\\047\047", states[ip])  # 处理单引号
          gsub(/\047/, "\047\\\047\047", services[ip])
  
          # 生成关联数组声明语句
          printf "declare -A ip_arr=(\n"
          printf "  [\"ip_addr\"]=\"%s\"\n", ip
          printf "  [\"connection_count\"]=%d\n", cnt[ip]
          printf "  [\"states\"]=\"%s\"\n", states[ip]
          printf "  [\"services\"]=\"%s\"\n", services[ip]
          printf ")\n"
      }
  }')"
  
  # 验证结果
  if declare -p ip_arr &> /dev/null; then
      echo "IP地址：${ip_arr["ip_addr"]}"
      echo "连接数：${ip_arr["connection_count"]}"
      echo "状态列表：${ip_arr["states"]}"
      echo "服务列表：${ip_arr["services"]}"
  else
      echo "未找到匹配的连接"
  fi
  
  json_data=$(cat <<EOF
  {
    "msg_type": "text",
    "content": {
      "text": "********** TCP连接警告 **********\\n\\nIP地址:\\n${ip_arr['ip_addr']}\\n\\n连接数:\\n${ip_arr['connection_count']}\\n\\n服务状态:\\n${ip_arr['states']}\\n服务:\\n${ip_arr['services']}"
    }
  }
  EOF
  )
  
  
  
  # if [ ${ip_arr["connection_count"]} -ge 500 ];then
  #     #echo "${ip_arr["connection_count"]}，大于 500"
  #     curl -X POST -H "Content-Type: application/json" \
  #              -d '{"msg_type":"text","content":{"text":"Foreign_ip:'''${ip_arr["ip_addr"]}\\n'''连接数:'''${ip_arr["connection_count"]}\\n'''服务状态:'''${ip_arr["states"]}\\n'''服务:'''${ip_arr["services"]}\\n'''"}}' \
  #              https://open.feishu.cn/open-apis/bot/v2/hook/xxxx
  # fi
  
  
  # 判断连接数是否大于500
  if [ ${ip_arr["connection_count"]} -ge 500 ];then
      # 发送请求到飞书
      curl -X POST -H "Content-Type: application/json" -d "$json_data" "$feishu_hook"
  else
      echo "连接数小于500，不发送飞书通知"
  fi