python語言，不介紹了例书。我這里就是Python 2.7來模擬訪問锣尉。主要是分析訪問日志【霾桑看那個(gè)是想DDOS攻擊的悟耘。還有就是看他們還的訪問次數(shù)等。下面是python模擬訪問的代碼织狐。
#coding:utf-8
import urllib2
import threading
def geturl():
url='http://192.168.1.103/'
rq=urllib2.Request(url)
rq.add_header("User-Agent","he he")
response=urllib2.urlopen(rq)
html=response.read()
print html
def doweb():
geturl()
for x in range(500):
t=threading.Thread(target=doweb)
t.start()
//額~直接訪問的次數(shù)可以直接改500這個(gè)數(shù)字就是想多少次就多少次暂幼。
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
61.145.146.60 - - [15/Sep/2016:16:06:00 +0800] "GET / HTTP/1.1" 200 45
//訪問日志表直接變成這個(gè)樣子筏勒。
netstat -apt //這個(gè)命令顯示tcp網(wǎng)絡(luò)使用情況，
1旺嬉、LISTENING狀態(tài) 服務(wù)啟動(dòng)后首先處于偵聽狀態(tài)管行。
2、ESTABLISHED狀態(tài) ESTABLISHED的意思是建立連接邪媳。表示兩臺(tái)機(jī)器正在通信捐顷。
3、CLOSE_WAIT 對(duì)方主動(dòng)關(guān)閉連接或者網(wǎng)絡(luò)異常導(dǎo)致連接中（自己關(guān)了瀏覽器）
4雨效、TIME_WAIT 我方主動(dòng)調(diào)用close()斷開連接迅涮，收到對(duì)方確認(rèn)后狀態(tài)變?yōu)門IME_WAIT
netstat -ant //顯示tcp模式運(yùn)行狀況 配合 netstat -ant | greep 80
netstat -ant| grep ESTABLISHED netstat -antp //顯示正在通訊IP
netstat -apt
tcp 0 0 121.40.76.153:80 61.145.146.60:6800 TIME_WAIT
tcp 0 0 121.40.76.153:43684 110.75.102.62:80 ESTABLISHED
tcp 0 0 121.40.76.153:80 61.145.146.60:6814 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6834 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6774 FIN_WAIT2
tcp 0 0 121.40.76.153:80 61.145.146.60:6796 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6808 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6804 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6752 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6786 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6750 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6818 TIME_WAIT
tcp 0 0 121.40.76.153:80 61.145.146.60:6762 TIME_WAIT
//由于都是靜態(tài)頁面直接TIME_WAIT
學(xué)習(xí)一個(gè)分析工具awk
//把文件逐行的讀入，以空格為默認(rèn)分隔符將每行切片徽龟，切開的部分再進(jìn)行各種分析處理
//記住叮姑，是空格
cat access_log | awk '{print $1}' //會(huì)輸出一堆ip,$1就是第一個(gè)，$2就是第二個(gè)自己試試吧
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
58.61.66.99
還有學(xué)習(xí)一個(gè)就是sort命令
//默認(rèn)按ascii排序,常用來排序非數(shù)字
//-n 按數(shù)字形式排序
//-r 倒排序
sort -n xxx
sort -rn xxx
還有一個(gè)uniq命令
//去除排序過的文件中的重復(fù)行据悔，因此uniq經(jīng)常和sort合用传透，所有的重復(fù)行必須是相鄰的。
//-c或--count 在每列旁邊顯示該行重復(fù)出現(xiàn)的次數(shù)
//-d或--repeated 僅顯示重復(fù)出現(xiàn)的行列极颓。
cat xxx | sort -n | uniq
cat xxx | sort -n | uniq -c
//這樣結(jié)合基本知道了誰比較喜歡經(jīng)常訪問
cat access_log | awk '{print $1}' | sort -n | uniq -c
//下面是用python的分析方法朱盐。把訪問日志下載下來。
python代碼
file=open("access_log.txt",mode="r")
try:
#str_lines=file.readlines()
line=file.readline()
tj={}
while line:
line_sp=line.split(' ')
if len(line_sp)>3:
if(tj.has_key(line_sp[0])):
tj[line_sp[0]]=tj[line_sp[0]]+1
else:
tj[line_sp[0]]=1
line=file.readline()
print sorted(tj.iteritems(),key=lambda abc:abc[1],reverse=True)
except Exception,e:
print e
finally:
file.close()
[('61.145.146.60', 51), ('58.61.66.99', 11), ('61.145.144.91', 1), ('169.229.3.91', 1), ('60.253.201.24', 1), ('61.145.129.33', 1)]
結(jié)果出來了菠隆，訪問最多的就是61.145.146.60兵琳，訪問了51次
