Monitor TcpOutRsts

TcpOutRsts.sh

#!/bin/bash
INTERVAL=5
THRESHOLD=5

echo "开始监控 TcpOutRsts..."
last_out_rsts=$(nstat -az TcpOutRsts | awk 'NR==2 {print $2}')

while true; do
    sleep $INTERVAL
    current_out_rsts=$(nstat -az TcpOutRsts | awk 'NR==2 {print $2}')
    diff=$((current_out_rsts - last_out_rsts))

    if [ "$diff" -gt "$THRESHOLD" ]; then
        echo "$(date '+%T') - [报警] $diff 个 Reset 发出"
        
        # 找到 ">" 所在的列号 (i)
        # 源地址就是 $(i-1)，目的地址就是 $(i+1)
        timeout 5 tcpdump -i any "tcp[tcpflags] & tcp-rst != 0" -nn -c 30 2>/dev/null | awk '{
            for(i=1; i<=NF; i++) {
                if($i == ">") {
                    src=$(i-1); dst=$(i+1);
                    sub(/[.:,]+$/, "", src); 
                    sub(/[.:,]+$/, "", dst);
                    print "本机源: " src "  ==>  外部目的: " dst
                }
            }
        }' | sort | uniq -c | sort -nr
        
        echo "----------------------------------------------------------------"
    fi
    last_out_rsts=$current_out_rsts
done