Be it a Ping Flood, SYN Flood, or any other DoS attack, the first step towards detecting a DoS attack is to detect an anomaly in network traffic on the system. That is the first-ever sign that can indicate the system may be having a DoS attack. If you can monitor the network traffic on your system and get informed about an anomaly well in advance, then you can take action, and probably, you still can prevent the attack. In this article, we will discuss how to make a simple tool for monitoring network traffic on the system. The tool should give an alert whenever there is a sudden increase in network traffic.

We can use a simple utility called tcpstat along with shell scripts for this purpose. The purpose of this article is to make a basic tool based on which you can make your own IDS (What is IDS?) or IPS (What is IPS?).

Firstly, we would need to install tcpstat in the system.

# sudo apt-get install tcpstat

Now, run this simple command in the terminal :

# sudo tcpstat -i eth1

You may have to select an appropriate network interface for your system. You can see now that tcpstat starts giving information like the number of network packets, bps, etc.

tcpstat also has an option ‘-o’ through which you can specify the output formatting. Here, I would use the format “%n,” which will give me the number of packets every 5 seconds.

Next, I would redirect the output to a file. And in a while loop, I will see the last line in the file, which gives the number of packets in the last 5 seconds. And then, I will compare the number with a threshold. I have experimented with a few attacks and determined the threshold to be 20,000 in my system.

Next, the job is simple. If the traffic goes beyond the threshold, set a flag. And if the increased traffic continues for a time, say, 15 seconds, I know that it is time for action to be taken. The action may be setting temporary new iptables rules or analyzing the traffic further.

So, here is how the script should look like :