anti_ddos.rb - it works and daemonises perfectly!! and works in loop, so only start ONCE!

#!/usr/bin/env ruby
# Attack 0.1 - A threaded (D)DoS-Deflate alternative written in Ruby (2008) works great!!! (xd)
require 'logger'

class Attack
        # The number of concurent connections per IP.
        CONNECTION_LIMIT = 5
        # The frequency (in seconds) that Attack checks the current connections.
        FREQUENCY = 30
        # The firewall. Available options: csf, apf or any other firewall that takes a -d IP argument.
        FIREWALL = "csf"
        # Connection checks and bans are logged here.
        LOG_FILE = "deflate_attack.log"
        # IP Whitelist.
        WHITELIST = %w{ 127.0.0.1 }
        def initialize
                @connections = `netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n`
                @log = Logger.new(LOG_FILE)
                daemonize
                loop do
                        run
                        sleep(FREQUENCY)
                end
        end
        def check(connections)
                connections.each { |connection|
                        conn, ip = connection.split
                        if conn.to_i > CONNECTION_LIMIT and not WHITELIST.include? ip
                                `#{FIREWALL} -d #{ip}`
                                @log.info "Blocked #{ip} with #{conn} connections."
                        end
                }
        end
        def run
                Thread.new {
                        check @connections
                        @log.info "Checked connections at #{Time.now}"
                }.join
        end
        protected
        def daemonize
          exit if fork
          Process.setsid
          exit if fork
          Dir.chdir "/"
          File.umask 0000
          STDIN.reopen "/dev/null"
          STDOUT.reopen "/dev/null", "a"
          STDERR.reopen STDOUT
          trap("TERM") { exit }
        end
end
Attack.new