Shell脚本命令有助于缩短？

Question

我有一个这样的命令：

/bin/netstat -an | /usr/bin/awk -vmax=100 '/tcp/{split($5,a,":"); if(a[1] > 0 && a[1]!="0.0.0.0" && a[1]!="127.0.0.1" && a[1]!="111.222.111.222" ... 50 addresses... && a[1]!="211.112.211.112"){c[a[1]]++}} END{for(ip in c){if(c[ip]>max){print ip}}}' | while read ip; do /sbin/iptables -m comment --comment "SCAN BLOCK" -I INPUT 1 -s $ip -j DROP; done

如何缩短它以从文件中读取 IP 地址，或者从命令上方的数组列表中读取 IP 地址，或者类似的东西，因为我现在有近 100 个 IP，并且在一个大命令行中都一个接一个。

基本上，如何使命令像这样：

/bin/netstat -an | /usr/bin/awk -vmax=100 '/tcp/{split($5,a,":"); if(a[1] > 0 && a[1]!="read from file"){c[a[1]]++}} END{for(ip in c){if(c[ip]>max){print ip}}}' | while read ip; do /sbin/iptables -m comment --comment "SCAN BLOCK" -I INPUT 1 -s $ip -j DROP; done

Answer 1

将 ips 列表放在一个文件中，例如：

$ cat iplist.txt
0.0.0.0
127.0.0.1
111.222.111.222
... snip ...
211.112.211.112

一般的方法是让awk 处理具有不同逻辑的 2 个输入文件，例如：

/bin/netstat -an | 
/usr/bin/awk -vmax=100 '

# process 1st file (iplist.txt): 

FNR==NR { iplist[$1]                 # FNR==NR is only true for the 1st file; for follow-on files FNR resets to 1 but NR keeps increasing
          next                       # skip to next input record; keeps from running follow-on code against 1st file contents
        }   

# process 2nd file (stdin):

/tcp/   { split($5,a,":")
          if (a[1] > 0 && !(a[1] in iplist))
             c[a[1]]++
        }
END     { for (ip in c) 
              if (c[ip]>max)
                 print ip
        }
' iplist.txt -                      # 2nd file actually says to read from stdin (ie, output from netstat call)

笔记：然后 OP 会将此输出通过管道传输到相同的 while/iptables 循环，例如：

/bin/netstat -an | 
/usr/bin/awk -vmax=100 '
FNR==NR { iplist[$1] 
... snip ...
                 print ip
        }
' iplist.txt - |  while read ip; do /sbin/iptables ...;done

# or collapsed to one line (though harder to read and/or troubleshoot):

netstat -an | awk -vmax=100 'FNR==NR{iplist[$1];next} /tcp/{split($5,a,":"); if (a[1] > 0 && !(a[1] in iplist)) c[a[1]]++} END{for (ip in c) if (c[ip]>max) print ip}' iplist.txt - | while read ip; do /sbin/iptables ...;done

Answer 2

如果您不关心输出顺序，为什么不像其他人建议的那样将第一个 iplist.txt 读入一个数组，然后只要它比您的 vmax 阈值大 1 就输出，例如：

# imagine the <( echo ... ) is the iplist.txt being read in

jot -b '1.0.0.1' 105 | gcat -n | 

mawk 'FNR==NR ? __[$(_<_)] : $NF in __  && 
                         __[ $NF ]++==+_' _='100' <( echo '1.0.0.1' ) -

101 1.0.0.1

ps：jot -w '%d 1.0.0.1' 105 也适用于 line 1，但第 1 行是什么并不重要，因为它代表通过管道输入的任何内容