Good day,
I have compiled a script that should monitor the number of packets for all IP addresses in the Queues and block them in the firewall if the number of packets passed a certain threshold, script is below.
It does still need a line to reset the counters after it has run, however it doesn’t run on my Mikrotik, I am testing it on RouterOS v6.15.
This is my first script, so please feel free to tell me what I am doing wrong or how this can be improved.
Thanks
:global interval;
:global threshold;
:set interval 10;
:set threshold 2000;
:local recipients {“user@example.com”}
:local subject “Subject of Message”
:for i from=1 to=254 do={
:if ([/queue simple find target-addresses=(“192.168.1.” . $i)] != “”) do={
:set pack [get [find target-addresses=(“192.168.1.” . $i)] packets]
:if ($pack / $interval > $threshold) do={
/ip firewall filter add action=reject chain=forward src-address=(“192.168.1.” . $i)
:foreach r in=[:toarray $recipients] do={
:put ("Sending email to " . [:tostr $r])
/tool e-mail send from=“abc@company.com” server=“serverIP” to=[:tostr $r] subject=[:tostr $subject] body=“Body of Message”
}
}
}
}