NETSTAT not showing real IPs using Cloudflare

domainerq

• February 27, 2017 00:57

Hello, I am using cloudflare ( I have configured apache in order to see the visitor's real ip in the log), and everything is working fine. I want to discard that my server is receiving DDOS attacks and i am trying to see the connections on port 80 sorted by IP, using the following command. netstat -anp | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n But when i execute this command i still get the cloudflare ip. there is something that need to be configured? or another way to identify the amount of connections by real ip? I would apreciate any suggestion, Thanks a lot.

• 

  cPanelMichael

  • February 27, 2017 17:57

  Hello, You may want to reach out to CloudFlare's support team for solutions to this issue, as the current solutions are designed for the Apache logs and not the netstat utility. A similar topic is discussed at: CloudFlare? - ConfigServer Community Forum Thank you.

  0
• 

  domainerq

  • March 08, 2017 05:05

  I am analyzing logs ,using the following commands has been enough . cat access.log | awk '{print $1 "->" $4"->" $6 " " $7}' | sort $1 cat access.log| awk '{print $1 " -> " $4" -> " $6 " " $7}' | grep x.x.x.x (to analize one ip) cat access.log| cut -d " " -f 1 | sort | uniq (unique ips that have accessed) cat access.log | cut -d " " -f 1 | sort | uniq | wc - (How many IPs have accessed in to your website today) cut -d " " -f 1 access.log | sort | uniq -c | sort -n (How many times each IP has accessed to your web) I hope it helps.

  0

Please sign in to leave a comment.