查看80端口的tcp连接
netstat -tan | grep "ESTABLISHED" | grep ":80" | wc -l
找出连接多的ip
netstat -ntu | awk '{print $5}' | sort | uniq -c | sort -nr
再找出appache日志中访问最多的ip
awk '{print $1}' access_log | sort | uniq -c | sort -nr
禁止从上面找到的异常IP
iptables -I INPUT -s 113.114.22.44 -j DROP
...