Useful to check DDoS attacks on servers.

This command takes the output of the 'last' command, removes empty lines, gets just the first field ($USERNAME), sort the $USERNAMES in reverse order and then gives a summary count of unique matches.

Sometimes, in a shell script, you need a random number bigger than the range of $RANDOM. This will print a random number made of four hex values extracted from /dev/urandom.

This is a 'killall' command equivalent where it is not available.

Prior to executing it, set the environment variable USERNAME to the username, whose processes you want to kill or replace the username with the $USERNAME on the command above.

Side effect: If any processes from other users, are running with a parameter of $USERNAME, they will be killed as well (assuming you are running this as root user)

[-9] in square brackets at the end of the command is optional and strongly suggested to be your last resort. I do not like to use it as the killed process leaves a lot of mess behind.

This command specifies the size in Kilobytes using 'k' in the -size +(N)k option. The plus sign says greater than. -exec [cmd] {} \; invokes ls -l command on each file and awk strips off the values of the 5th (size) and the 9th (filename) column from the ls -l output to display. Sort is done in reversed order (descending) numerically using sort -rn options.

A cron job could be run to execute a script like this and alert the users if a dir has files exceeding certain size, and provide file details as well.

The $2, $3, $4 fields are arbitrary but note that the first field starts from $2 and the last field is $NF-1. This is due to the fact that the leading and trailing quotes are treated as field delimiters.

changes the PS1 to something better than default.

[username.hostname.last-2-digits-of-ip] (current directory)

For quick validation of folder's file-contents (structure not taken into account) - I use it mostly to check if two folders' contents are the same.

Very useful set of commands to know when your file system was created.

This gets you your default route programatically, useful for scripts

This command does a tally of concurrent active connections from single IPs and prints out those IPs that have the most active concurrent connections. VERY useful in determining the source of a DoS or DDoS attack.

This is the simple revision number on stdout, that can be fed to any useful/fun script of yours. Setting LC_ALL is useful if you use another locale, in which case "Revision" is translated and cannot be found. I use this with doxygen to insert my source files revisions into the doc. An example in Doxyfile:

FILE_VERSION_FILTER = "function svn_filter { LC_ALL=C svn info $1 | grep Revision | awk '{print $2}'; }; svn_filter"

Share your ideas about what to do with the revision number !

Very useful for finding all files over a specified size, such as out of control log files chewing up all available disk space. Fedora Core x specific version.

This will tell you who has the most Apache connections by IP (replace IPHERE with the actual IP you wish to check). Or if you wish, remove | grep -c IPHERE for the full list.

List top 20 IP from which TCP connection is in SYN_RECV state.

Useful on web servers to detect a syn flood attack.

Replace SYN_ with ESTA to find established connections

This command is useful when you want to know what process is responsible for a certain GUI application and what command you need to issue to launch it in terminal.

After you install/remove lots of packages, there are many packages marked with 'rc'. This script help you to purge these packages, it will save some spaces from your disk.

usefull in case of abuser/DoS attacks.

Do ls with permissions written in octal form.