◆◆0

网站日志分析实战：一键统计访问IP TOP20与C段流量

来源： 2026-05-24 19:41:11 Linux 129 0

前言：网站运维中，分析访问日志是排查恶意攻击、识别异常流量、优化CDN策略的必备技能。本文通过四个常用Linux命令组合，快速统计日志中最活跃的IP地址、C段（/24）流量分布，并针对特定IP段（如221.229）进行去重计数与总量统计，适合Nginx/Apache日志格式，一键复制即用。
最近网站日志分析发现，每天都有大量来自 221.229.0.0/16 网段的IP持续高频率访问网站，行为特征明显不是正常用户：
IP归属：江苏扬州电信
访问特征：单IP请求量巨大（如日志显示单个IP高达11万次），短时间内爆发式请求
封禁无效：即使通过防火墙封停该IP段，过段时间攻击者会切换到同一大段下的其他新IP继续攻击
持续换段：虽然集中在 221.229.x.x 这个B段内，但攻击IP不断轮换，手动封禁根本跟不上。
1、输出网站访问日志中访问最大的前20个ip地址并显示次数

echo "=== 前20个IP ===" && awk '{print $1}' tag.gg.log | sort | uniq -c | sort -nr | head -20

输出：

[root@blog-tag-gg-Test wwwlogs]# echo "=== 前20个IP ===" && awk '{print $1}' tag.gg.log | sort | uniq -c | sort -nr | head -20
=== 前20个IP ===
114016 211.101.238.231
12310 64.186.233.39
9082 130.33.48.90
4580 185.177.72.50
4367 185.177.72.60
3230 63.135.161.76
3053 172.190.142.176
2655 35.211.166.124
2592 221.229.173.103
2558 221.229.197.130
2554 63.135.161.57
2520 20.220.232.240
2444 221.229.210.80
2436 221.229.202.219
2346 221.229.210.96
2345 221.229.173.134
2341 221.229.202.160
2292 221.229.202.165
2254 221.229.197.67
2252 20.196.93.105

2、输出网站访问日志中访问最大的前20个ip C地址并显示次数

echo "=== 前20个C段 ===" && awk '{print $1}' tag.gg.log | awk -F'.' '{print $1"."$2"."$3".0/24"}' | sort | uniq -c | sort -nr | head -20

输出：

[root@blog-tag-gg-Test wwwlogs]# echo "=== 前20个C段 ===" && awk '{print $1}' tag.gg.log | awk -F'.' '{print $1"."$2"."$3".0/24"}' | sort | uniq -c | sort -nr | head -20
=== 前20个C段 ===
337906 221.229.173.0/24
302898 221.229.202.0/24
217641 221.229.197.0/24
158812 221.229.210.0/24
114016 211.101.238.0/24
47065 180.97.250.0/24
43345 58.218.211.0/24
12310 64.186.233.0/24
10682 185.177.72.0/24
9643 66.249.66.0/24
9082 130.33.48.0/24
7417 63.135.161.0/24
5401 85.203.44.0/24
5268 59.82.135.0/24
5169 113.215.189.0/24
4378 59.82.83.0/24
3517 66.249.92.0/24
3426 20.220.232.0/24
3053 172.190.142.0/24
2655 35.211.166.0/24

3、同时输出TOP20 IP与TOP20 C段

echo "=== 前20个IP ===" && awk '{print $1}' tag.gg.log | sort | uniq -c | sort -nr | head -20 && echo "" && echo "=== 前20个C段 ===" && awk '{print $1}' tag.gg.log | awk -F'.' '{print $1"."$2"."$3".0/24"}' | sort | uniq -c | sort -nr | head -20

输出：

[root@blog-tag-gg-Test wwwlogs]# echo "=== 前20个IP ===" && awk '{print $1}' tag.gg.log | sort | uniq -c | sort -nr | head -20 && echo "" && echo "=== 前20个C段 ===" && awk '{print $1}' tag.gg.log | awk -F'.' '{print $1"."$2"."$3".0/24"}' | sort | uniq -c | sort -nr | head -20
=== 前20个IP ===
114016 211.101.238.231
12310 64.186.233.39
9082 130.33.48.90
4580 185.177.72.50
4367 185.177.72.60
3230 63.135.161.76
3053 172.190.142.176
2655 35.211.166.124
2592 221.229.173.103
2558 221.229.197.130
2554 63.135.161.57
2520 20.220.232.240
2444 221.229.210.80
2436 221.229.202.219
2346 221.229.210.96
2345 221.229.173.134
2341 221.229.202.160
2292 221.229.202.165
2254 221.229.197.67
2252 20.196.93.105

=== 前20个C段 ===
337892 221.229.173.0/24
302898 221.229.202.0/24
217641 221.229.197.0/24
158812 221.229.210.0/24
114016 211.101.238.0/24
47065 180.97.250.0/24
43345 58.218.211.0/24
12310 64.186.233.0/24
10682 185.177.72.0/24
9643 66.249.66.0/24
9082 130.33.48.0/24
7417 63.135.161.0/24
5401 85.203.44.0/24
5268 59.82.135.0/24
5169 113.215.189.0/24
4378 59.82.83.0/24
3517 66.249.92.0/24
3426 20.220.232.0/24
3053 172.190.142.0/24
2655 35.211.166.0/24

4、统计特定B段（如221.229.x.x）的总请求次数

awk '{print $1}' tag.gg.log | grep "^221\.229" | wc -l

输出：

[root@blog-tag-gg-Test wwwlogs]# awk '{print $1}' tag.gg.log | grep "^221\.229" | wc -l
1017806

5、列出特定B段下去重后的IP地址

awk '{print $1}' tag.gg.log | grep "^221\.229" | sort -u

输出：

[root@blog-tag-gg-Test wwwlogs]# awk '{print $1}' tag.gg.log | grep "^221\.229" | sort -u
221.229.106.25
221.229.161.102
221.229.161.14
221.229.161.142
221.229.161.149
221.229.161.15
221.229.161.189
221.229.161.196

6、统计特定B段下每个IP的详细请求次数

awk '{print $1}' tag.gg.log | grep "^221\.229" | sort | uniq -c | sort -nr

输出：

[root@blog-tag-gg-Test wwwlogs]# awk '{print $1}' tag.gg.log | grep "^221\.229" | sort | uniq -c | sort -nr
2592 221.229.173.103
2558 221.229.197.130
2444 221.229.210.80
2436 221.229.202.219
2346 221.229.210.96
2345 221.229.173.134
2341 221.229.202.160
2292 221.229.202.165
2254 221.229.197.67
2238 221.229.202.205
2220 221.229.202.171
2189 221.229.210.23
2189 221.229.202.170

7、显示当前建立连接的ip和次数以及状态。

netstat -tn | grep -E ':80|:443' | awk '{print $5, $6}' | awk -F':' '{print $1, $NF, $2}' | awk '{printf "%-10s %-20s %-15s\n", $3, $1, $2}' | sort | uniq -c | sort -nr | head -30 | awk 'BEGIN{printf "%-10s %-20s %-15s\n","连接数","IP地址","状态"} {printf "%-10s %-20s %-15s\n",$1,$2,$3}'

输出：

[root@blog-tag-gg-Test wwwlogs]# netstat -tn | grep -E ':80|:443' | awk '{print $5, $6}' | awk -F':' '{print $1, $NF, $2}' | awk '{printf "%-10s %-20s %-15s\n", $3, $1, $2}' | sort | uniq -c | sort -nr | head -30 | awk 'BEGIN{printf "%-10s %-20s %-15s\n","连接数","IP地址","状态"} {printf "%-10s %-20s %-15s\n",$1,$2,$3}'
连接数 IP地址状态
1 TIME_WAIT 66.249.92.6
1 TIME_WAIT 66.249.92.5
1 TIME_WAIT 66.249.92.44
1 TIME_WAIT 66.249.92.192
1 TIME_WAIT 66.249.92.165
1 TIME_WAIT 66.249.92.164
1 TIME_WAIT 66.249.92.133
1 TIME_WAIT 66.249.92.132
1 TIME_WAIT 66.249.66.44
1 TIME_WAIT 66.249.66.32
1 TIME_WAIT 221.229.202.91

8、需要单独显示 C 段汇总统计（合并相同 C 段的总连接数）

echo "=== IP详情（含C段） ===" && netstat -tn | grep -E ':80|:443' | awk '{print $5, $6}' | awk -F':' '{print $1, $NF}' | awk '{print $1, $2}' | sort | uniq -c | sort -nr | head -30 | awk 'BEGIN{printf "%-8s %-20s %-12s %-18s\n","连接数","IP地址","状态","C段地址"} {split($2, a, "."); cidr=a[1]"."a[2]"."a[3]".0/24"; printf "%-8s %-20s %-12s %-18s\n", $1, $2, $3, cidr}' && echo "" && echo "=== C段汇总 ===" && netstat -tn | grep -E ':80|:443' | awk '{print $5}' | cut -d':' -f1 | awk -F'.' '{print $1"."$2"."$3".0/24"}' | sort | uniq -c | sort -nr | head -20 | awk 'BEGIN{printf "%-10s %-25s\n","总连接数","C段地址"} {printf "%-10s %-25s\n",$1,$2}'

输出：

=== IP详情（含C段） ===
连接数 IP地址状态 C段地址
45 211.101.238.231 ESTABLISHED 211.101.238.0/24
23 64.186.233.39 ESTABLISHED 64.186.233.0/24
12 130.33.48.90 TIME_WAIT 130.33.48.0/24
8 185.177.72.50 ESTABLISHED 185.177.72.0/24
5 221.229.173.103 SYN_RECV 221.229.173.0/24
3 221.229.202.219 FIN_WAIT2 221.229.202.0/24
2 221.229.202.160 ESTABLISHED 221.229.202.0/24
2 221.229.202.165 TIME_WAIT 221.229.202.0/24

=== C段汇总 ===
总连接数 C段地址
52 221.229.202.0/24
45 211.101.238.0/24
23 64.186.233.0/24
12 130.33.48.0/24
8 185.177.72.0/24
5 221.229.173.0/24

9、只显示当前连接数的ip段和ip段次数和状态。

netstat -tn | grep -E ':80|:443' | awk '{print $5, $6}' | awk '{split($1, ip_port, ":"); ip=ip_port[1]; state=$2; split(ip, a, "."); if(length(a)==4) cidr=a[1]"."a[2]"."a[3]".0/24"; else cidr="invalid"; print cidr, state}' | sort | uniq -c | sort -nr | awk 'BEGIN{printf "%-10s %-25s %-15s\n","连接数","C段地址","状态"} {printf "%-10s %-25s %-15s\n",$1,$2,$3}' | head -30

输出：

[root@blog-tag-gg-Test wwwlogs]# netstat -tn | grep -E ':80|:443' | awk '{print $5, $6}' | awk '{split($1, ip_port, ":"); ip=ip_port[1]; state=$2; split(ip, a, "."); if(length(a)==4) cidr=a[1]"."a[2]"."a[3]".0/24"; else cidr="invalid"; print cidr, state}' | sort | uniq -c | sort -nr | awk 'BEGIN{printf "%-10s %-25s %-15s\n","连接数","C段地址","状态"} {printf "%-10s %-25s %-15s\n",$1,$2,$3}' | head -30
连接数 C段地址状态
3 66.249.66.0/24 TIME_WAIT
2 100.100.192.0/24 TIME_WAIT
1 66.249.66.0/24 ESTABLISHED
1 123.139.39.0/24 TIME_WAIT
1 113.117.63.0/24 ESTABLISHED
1 100.100.36.0/24 ESTABLISHED
1 100.100.30.0/24 ESTABLISHED
1 100.100.100.0/24 TIME_WAIT

10、查看某个是什么服务发起访问的。

ss -tnp | grep '100.100.30.25'

输出：

[root@blog-tag-gg-Test wwwlogs]# ss -tnp | grep '100.100.30.25'
ESTAB 0 1142 172.26.12.71:38828 100.100.30.25:80 users:(("AliYunDun",pid=1122,fd=10))
[root@blog-tag-gg-Test wwwlogs]# ss -tnp | grep '100.100.30.25'

11、查看所有对外连接的进程（最常用）

netstat -tnp | grep ESTABLISHED | awk '{print $4, $5, $7}'

输出：

[root@blog-tag-gg-Test wwwlogs]# netstat -tnp | grep ESTABLISHED | awk '{print $4, $5, $7}'
172.26.12.71:443 221.229.202.127:44264 30287/nginx:
172.26.12.71:38828 100.100.30.25:80 1122/AliYunDun
172.26.12.71:443 66.249.66.192:65213 30287/nginx:
172.26.12.71:45442 100.100.36.89:443 18512/hbrclient
172.26.12.71:443 221.229.197.92:39262 30287/nginx:
172.26.12.71:32490 183.220.116.87:1335 30171/python3
172.26.12.71:80 113.215.189.46:38289 30288/nginx:

12、实时监控新发起的连接

watch -n 1 'netstat -tnp | grep ESTABLISHED | tail -20'

输出：

Every 1.0s: netstat -tnp | grep ESTABLISHED | tail -20 Sun May 24 20:42:15 2026

tcp 0 0 172.26.12.71:38828 100.100.30.25:80 ESTABLISHED 1122/AliYunDun
tcp 0 0 172.26.12.71:443 183.220.116.87:1215 ESTABLISHED 30288/nginx: worker
tcp 0 0 172.26.12.71:45442 100.100.36.89:443 ESTABLISHED 18512/hbrclient
tcp 0 0 172.26.12.71:32490 183.220.116.87:1335 ESTABLISHED 30171/python3

声明：站长码字很辛苦啊,转载时请保留本声明及附带文章链接：https://blog.tag.gg/showinfo-3-36393-0.html

亲爱的：若该文章解决了您的问题,可否收藏+评论+分享呢？

相关文章

文章评论 本文章有个评论

文章评论本文章有个评论