DDoS: Traffic Analysis and Dump

# Ubuntu/Debian
sudo apt install tcpdump ngrep net-tools

# CentOS/RHEL
sudo yum install tcpdump ngrep net-tools

# Identify your network interface
ip a
# usually eth0, ens3, ens18

# Capture 60 seconds on eth0 and save to file
sudo tcpdump -i eth0 -w /tmp/attack-$(date +%Y%m%d-%H%M%S).pcap -G 60 -W 1

# Capture only traffic on port 80/443 (HTTP attacks)
sudo tcpdump -i eth0 -w /tmp/dump-http.pcap port 80 or port 443

# Capture only UDP (volumetric/amplification)
sudo tcpdump -i eth0 -w /tmp/dump-udp.pcap udp

# Capture only SYN flood (TCP)
sudo tcpdump -i eth0 -w /tmp/dump-syn.pcap "tcp[tcpflags] & (tcp-syn) != 0"

# Maximum 100 MB, then stop
sudo tcpdump -i eth0 -w /tmp/dump.pcap -C 100

# Capture for 30 seconds
sudo timeout 30 tcpdump -i eth0 -w /tmp/dump.pcap

# Count source IPs in real-time
sudo tcpdump -i eth0 -nn -c 10000 2>/dev/null | \
  awk '{print $3}' | \
  cut -d. -f1-4 | \
  sort | uniq -c | sort -rn | head -20

# Connections by TCP state
ss -s

# Top IPs by active connections
ss -tn | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# Alternative with netstat
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# Bytes per second per interface
watch -n1 'cat /proc/net/dev | grep eth0'

# Or with ifstat (install if missing)
sudo apt install ifstat -y
ifstat -i eth0 1

sudo tcpdump -i eth0 -nn "tcp[tcpflags] & (tcp-syn) != 0 and tcp[tcpflags] & (tcp-ack) == 0" | \
  awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -10

sudo tcpdump -i eth0 -nn udp | \
  awk '{print $3, $5}' | sort | uniq -c | sort -rn | head -20

# Analyze Nginx access log
sudo tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# Requests by user-agent
sudo awk '{print $12}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Requests by URL
sudo awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

sudo tcpdump -i eth0 -nn icmp | \
  awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head -10

# PPS (packets per second) and BPS (bits per second) on eth0
sudo tcpdump -i eth0 -nn -q 2>&1 | pv -l -r > /dev/null

# Or with iftop (visual interface)
sudo apt install iftop -y
sudo iftop -i eth0 -n

# SYN only
tcp.flags.syn==1 && tcp.flags.ack==0

# UDP only
udp

# Specific IP
ip.src == 1.2.3.4

# Top talkers: Statistics > Conversations

# Port distribution: Statistics > Endpoints

# Block single IP
sudo iptables -A INPUT -s 1.2.3.4 -j DROP

# Block CIDR range
sudo iptables -A INPUT -s 1.2.3.0/24 -j DROP

# Save rules (Ubuntu)
sudo iptables-save > /etc/iptables/rules.v4

# Blocking with ipset (for many IPs)
sudo apt install ipset
sudo ipset create blacklist hash:ip
sudo ipset add blacklist 1.2.3.4
sudo iptables -A INPUT -m set --match-set blacklist src -j DROP