我如何转储 TCP 数据包以更好地了解哪个网站受到了攻击？
以下是我的日志中的内容：
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=51.120.142.200 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=64643 PROTO=TCP SPT=6433 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:26 host kernel: [2130002.635046] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=162.35.168.3 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=32964 PROTO=TCP SPT=38463 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:26 host kernel: [2130002.635139] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=168.112.108.150 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=28524 PROTO=TCP SPT=12511 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:26 host kernel: [2130002.635174] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=134.210.162.215 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=34079 PROTO=TCP SPT=51221 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:26 host kernel: [2130002.635310] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=54.114.224.137 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=52817 PROTO=TCP SPT=59374 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:28 host kernel: [2130004.631516] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=17.17.80.156 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=57197 PROTO=TCP SPT=25322 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:30 host kernel: [2130006.628179] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=169.95.251.80 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=85 PROTO=TCP SPT=27412 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:32 host kernel: [2130008.624842] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=114.73.202.181 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=26470 PROTO=TCP SPT=15474 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:34 host kernel: [2130010.621519] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=162.134.103.25 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=35261 PROTO=TCP SPT=31523 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:36 host kernel: [2130012.618218] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=99.25.73.187 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=15447 PROTO=TCP SPT=56379 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May 4 23:10:38 host kernel: [2130014.614953] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=200.93.185.230 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=24173 PROTO=TCP SPT=12497 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
我想知道哪个网站被攻击了，以便将其从服务器中删除。我在同一个 IP 上有 100 多个网站/域名。
编辑：这有帮助吗？这是（host.mydomain.com 没有指向被攻击的 IP）
tcpdump -vvv > dump
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C78 packets captured
188615 packets received by filter
188484 packets dropped by kernel
host.myhostname.com.39753 > google-public-dns-a.google.com.domain: [bad udp cksum 7b5b!] 43080+ PTR? 37.145.115.216.in-addr.arpa. (45)
23:33:26.591283 IP (tos 0x0, ttl 64, id 46350, offset 0, flags [DF], proto UDP (17), length 71)
host.myhostname.com.7664 > google-public-dns-a.google.com.domain: [bad udp cksum 7e14!] 50588+ PTR? 67.247.76.69.in-addr.arpa. (43)
23:33:26.591313 IP (tos 0x0, ttl 246, id 40924, offset 0, flags [none], proto TCP (6), length 40)
139.130.25.28.35498 > host.myhostname.com.http: Flags [S], cksum 0x1ea7 (incorrect -> 0x5c03), seq 3788177408, win 0, length 0
23:33:26.686457 IP (tos 0x0, ttl 246, id 6637, offset 0, flags [none], proto TCP (6), length 40)
255.233.72.118.adsl-pool.sx.cn.47086 > host.myhostname.com.http: Flags [S], cksum 0x8df9 (incorrect -> 0xb6e9), seq 2650210304, win 0, length 0
23:33:26.702689 IP (tos 0x0, ttl 246, id 58506, offset 0, flags [none], proto TCP (6), length 40)
client-86-25-29-28.midd-bam-1.adsl.virginmedia.com.65189 > host.myhostname.com.http: Flags [S], cksum 0x65eb (incorrect -> 0x3851), seq 3270180864, win 0, length 0
23:33:26.723599 IP (tos 0x0, ttl 246, id 16306, offset 0, flags [none], proto TCP (6), length 40)
10.23.136.178.childkey-notif > host.myhostname.com.http: Flags [S], cksum 0x0545 (incorrect -> 0x2119), seq 2983329792, win 0, length 0
23:33:26.723656 IP (tos 0x0, ttl 64, id 46482, offset 0, flags [DF], proto UDP (17), length 72)
host.myhostname.com.25322 > google-public-dns-a.google.com.domain: [bad udp cksum 949b!] 27893+ PTR? 128.254.19.14.in-addr.arpa. (44)
23:33:26.745875 IP (tos 0x0, ttl 64, id 46504, offset 0, flags [DF], proto UDP (17), length 71)
host.myhostname.com.icl-twobase4 > google-public-dns-a.google.com.domain: [bad udp cksum 6be5!] 60864+ PTR? 167.6.71.169.in-addr.arpa. (43)
23:33:26.797031 IP (tos 0x0, ttl 64, id 46555, offset 0, flags [DF], proto UDP (17), length 72)
host.myhostname.com.49262 > google-public-dns-a.google.com.domain: [bad udp cksum 487!] 64053+ PTR? 140.53.122.44.in-addr.arpa. (44)
23:33:26.881726 IP (tos 0x0, ttl 246, id 48847, offset 0, flags [none], proto TCP (6), length 40)
23-30-27-202-static.hfc.comcastbusiness.net.62003 > host.myhostname.com.http: Flags [S], cksum 0x68d5 (incorrect -> 0xf99f), seq 1314652160, win 0, length 0
23:33:26.881755 IP (tos 0x0, ttl 246, id 7932, offset 0, flags [none], proto TCP (6), length 40)
4.57.107.39.57966 > host.myhostname.com.http: Flags [S], cksum 0x0701 (incorrect -> 0xc4fc), seq 1447821312, win 0, length 0
答案1
使用 wireshark 或 tcpdump 加上 -vvv 并查看数据包中的 DNS 名称。SYN 洪水可能只是指向您的 IP 地址。