Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VERY old kernel version which for dumb "boss who thinks he knows everything" reasons i can not update. I need to either fire my boss or make a bash script that can add an iptable rule everytime it reads a different ip with dmesg. How can i make this. For the moment i have this which works good but it keeps duplicating the IP for obvious reasons on how iptable works there. I need to find a way to, before appending the IP, i want to make sure the ip is NOT in the iptable list already:

for BADIP in $(dmesg | grep 'Treason uncloaked!' | cut -d' ' -f6 | cut -d':' -f1 | sort --unique)
iptables -A INPUT -s $BADIP -j DROP
share|improve this question
Perhaps I am miss-reading, but this appears to be non-fatal error. Have you seen this? How is your script running? Can you just do a uniq on the dmesg output? If you are blocking things properly you should never see a second packet. – Zoredache Mar 3 '11 at 0:14
Why? I just checked dmesg and the only IP with the window shrinking message belongs to one of our biggest clients according to our application log. If I blocked that, I would have to have a really good explanation. – DerfK Mar 3 '11 at 0:28
Remember that the script will read AGAIN dmesg which has the Treason uncloacked part there still so it will add it again to the iptables. I need to make sure that BEFORE it adds it again it checks if it exists in the iptables – Luis Alvarado Mar 3 '11 at 0:34
you can use dmesg -c which will delete contents of ring buffer after it's printed to STDOUT, so next time you wont parse the same lines, but yes checking for IPs in existing firewall rules is way to go. – Hrvoje Špoljar Mar 3 '11 at 2:32
up vote 1 down vote accepted

Why not just use Fail2Ban? It should be easy enough to setup a filter for it.

However, something like the following would also work.

for BADIP in $(dmesg | grep 'Treason uncloaked!' | cut -d' ' -f6 | cut -d':' -f1 | sort --unique)
    iptables -L INPUT | grep $BADIP
    if [ $? -ne 0 ]
        iptables -A INPUT -s $BADIP -j DROP

Untested, but the basics are that $? is the exit code of the last command. If grep finds the ip, it will exit with 0. If grep fails to find the ip, it will be non-zero and the if condition will be triggered.

share|improve this answer
How can i tell it to not output to console but leave it within the script. Since it outputs to console the information. – Luis Alvarado Mar 3 '11 at 0:46
Got it. Just added > /dev/null & to the executable script. Thank you – Luis Alvarado Mar 3 '11 at 1:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.