上云基础教程系列–初次建站用户在阿里云如何选择合适的服务
初次建站用户在阿里云如何选择合适的服务;使用本站提供的优惠码:zvnge7可以享受九折优惠;本站提供的优惠码适合非保有云弹性Web托管，ECS，RDS，云解析情况下使用，不是第一次购买也可以使用。
简介：
CC攻击非常简单，不需要什么技术即可发起；且成本低廉。从网上下载一个攻击器即可发起。现在的新手站长往往不具备分析日志的水平；在网站访问越来越慢的情况下，无法判断网站是否遭遇攻击。本教程给出3条判断命令；通过这3条命令可以很方便的知道网站是否遭受CC攻击。
命令安装：
一般情况下系统不会默认安装tcpdump命令，需要自行安装。
Centos安装方法：
yum install -y tcpdump debian/ubuntu安装方法：
apt-get install -y tcpdump
判断方法：
第一条命令：
tcpdump -s0 -A -n -i any | grep -o -E ‘(GET|POST|HEAD) .*’
正常的输出如下：
POST /ajax/validator.php HTTP/1.1 POST /api_redirect.php HTTP/1.1 GET /team/57085.html HTTP/1.1 POST /order/pay.php HTTP/1.1 GET /static/goodsimg/20140324/1_47.jpg HTTP/1.1 GET /static/theme/qq/css/index.css HTTP/1.1 GET /static/js/index.js HTTP/1.1 GET /static/js/customize.js HTTP/1.1 GET /ajax/loginjs.php?type=topbar& HTTP/1.1 GET /static/js/jquery.js HTTP/1.1 GET /ajax/load_team_time.php?team_id=57085 HTTP/1.1 GET /static/theme/qq/css/index.css HTTP/1.1 GET /static/js/lazyload/jquery.lazyload.min.js HTTP/1.1 GET /static/js/MSIE.PNG.js HTTP/1.1 GET /static/js/index.js HTTP/1.1 GET /static/js/customize.js HTTP/1.1 GET /ajax/loginjs.php?type=topbar& HTTP/1.1 GET /static/theme/qq/css/i/logo.jpg HTTP/1.1 GET /static/theme/qq/css/i/logos.png HTTP/1.1 GET /static/theme/qq/css/i/hot.gif HTTP/1.1 GET /static/theme/qq/css/i/brand.gif HTTP/1.1 GET /static/theme/qq/css/i/new.gif HTTP/1.1 GET /static/js/jquery.js HTTP/1.1 GET /static/theme/qq/css/i/logo.jpg HTTP/1.1
如果网站正常，那么在日志里面看见的都是一些静态文件，如图片，CSS,JS等。如果被攻击，就会出现大量的固定链接，会出现大量含有一定特征的地址。例如Discuz类的站点被攻击，就会出现大量类似于/thread-随机数字-1-1.html的地址。
第二条命令：
tcpdump -s0 -A -n -i any | grep ^User-Agent;
正常的输出如下：
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space) User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space) User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +https://www.bing.com/bingbot.htm) User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; InfoPath.2) User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
这个命令可以查看客户端的useragent；目前大量的CC攻击采用CC攻击工具实现；他们的客户端的useragent往往都是一致的；在遭受到CC攻击的往往会看到同一个useragent在刷屏。
第三条命令：
tcpdump -s0 -A -n -i any | grep ^Host ;
正常的输出如下：
Host: www.pig123.com Host: www.pig123.com Host: www.pig123.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: www.pig123.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: www.pig123.com Host: www.pig123.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: www.pig123.com Host: upload.57aliyun.com Host: upload.57aliyun.com Host: www.pig123.com
当同一服务器上存在大量站点时，使用该命令可以快速判断遭受CC攻击的域名。
