I am trying to list a number of offending IP's with a one line command, and am not sure how to do the last little bit, maybe someone can point me in the right direction.
cat /var/log/syslog* | grep "SRC=" | cut -d " " -f 14 | sort | uniq -c | sort -n -r
In English...this should print all syslog files (also those rotated), search for entries of the Firewall and grab the SRC value (IP), count them and list them from highest to lowest. All I want now is to limit it to the top 5... Anybody know a command that can do that ?
Example entry in syslog:
Jan 11 12:01:52 xxxx kernel: [47261.722647] INPUT packet died: IN=eth0 OUT= MAC=44:8a:5b:a0:24:eb:00:31:46:0d:21:e8:08:00 SRC=xx.xx.xx.xx DST=xx.xx.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=33840 PROTO=TCP SPT=1024 DPT=22151 WINDOW=1024 RES=0x00 SYN URGP=0
The entries are made by my custom Firewall, not part of this Question
Example output of the command:
47 SRC=22.214.171.124 2 SRC=126.96.36.199 2 SRC=188.8.131.52 2 SRC=184.108.40.206 1 SRC=220.127.116.11 1 SRC=18.104.22.168 1 SRC=22.214.171.124 1 SRC=126.96.36.199 1 SRC=188.8.131.52 1 SRC=184.108.40.206 1 SRC=220.127.116.11 1 SRC=18.104.22.168 1 SRC=22.214.171.124 1 SRC=126.96.36.199 1 SRC=188.8.131.52 1 SRC=184.108.40.206 1 SRC=220.127.116.11 1 SRC=18.104.22.168 1 SRC=22.214.171.124