#!/bin/bash

PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

export max=10
WARNING=35
CRITICAL=60

STATE_OK=0
STATE_WARNING=1
STATE_CRITICAL=2
STATE_UNKNOWN=3

print_usage() {
	echo "Usage: $0 -w <warning> -c <critical> [-m <min_connections_per_ip>]"
	echo
	echo "Options:"
	echo "  -w   Warning threshold for average connections"
	echo "  -c   Critical threshold for average connections"
	echo "  -m   Minimum connections per remote IP to include in average. Default: 10"
	echo
	echo "Example:"
	echo "  $0 -w 35 -c 60"
	echo "  $0 -m 10 -w 35 -c 60"
}

while getopts "w:c:m:h" opt; do
	case "$opt" in
		w)
			WARNING="$OPTARG"
			;;
		c)
			CRITICAL="$OPTARG"
			;;
		m)
			export max="$OPTARG"
			;;
		h)
			print_usage
			exit $STATE_OK
			;;
		*)
			print_usage
			exit $STATE_UNKNOWN
			;;
	esac
done

if ! [[ "$WARNING" =~ ^[0-9]+([.][0-9]+)?$ ]]; then
	echo "UNKNOWN - warning threshold must be numeric"
	exit $STATE_UNKNOWN
fi

if ! [[ "$CRITICAL" =~ ^[0-9]+([.][0-9]+)?$ ]]; then
	echo "UNKNOWN - critical threshold must be numeric"
	exit $STATE_UNKNOWN
fi

if ! [[ "$max" =~ ^[0-9]+$ ]]; then
	echo "UNKNOWN - minimum connections per IP must be numeric"
	exit $STATE_UNKNOWN
fi

if ! command -v netstat >/dev/null 2>&1; then
	echo "UNKNOWN - netstat command not found"
	exit $STATE_UNKNOWN
fi

RESULT=$(
	netstat -atupn | awk '!/0.0.0.0/&&!/::/&&!/127.0.0.1/{gsub(/:.*/,"",$5);print $1,$5}' | sort | uniq -c | sort -nk1 | awk '
	BEGIN {
		while (("ip -4 -o addr show" | getline) > 0) {
			split($4,a,"/");
			local[a[1]]=1;
		}

		local["167.114.94.47"]=1; # dnsr1
		local["173.209.51.90"]=1; # dnsr2
	}

	$1>ENVIRON["max"] {
		if ($3 in local) {
			next;
		} else {
			conns+=$1;
			count++;
		}
	}

	END {
		if (count == 0) {
			avg=0;
		} else {
			avg=conns/count;
		}

		printf "%.2f %d %d\n", avg, conns, count;
	}'
)

AVG=$(echo "$RESULT" | awk '{print $1}')
TOTAL_CONNS=$(echo "$RESULT" | awk '{print $2}')
IP_COUNT=$(echo "$RESULT" | awk '{print $3}')

if [[ -z "$AVG" ]]; then
	echo "UNKNOWN - unable to calculate average connections"
	exit $STATE_UNKNOWN
fi

COMPARE_CRITICAL=$(awk -v avg="$AVG" -v critical="$CRITICAL" 'BEGIN { if (avg > critical) print 1; else print 0 }')
COMPARE_WARNING=$(awk -v avg="$AVG" -v warning="$WARNING" 'BEGIN { if (avg > warning) print 1; else print 0 }')

if [[ "$COMPARE_CRITICAL" -eq 1 ]]; then
	echo "CRITICAL - average connections is ${AVG}, total connections: ${TOTAL_CONNS}, IP count: ${IP_COUNT}, min per IP: ${max} | avg_conns=${AVG};${WARNING};${CRITICAL};0; total_conns=${TOTAL_CONNS} ip_count=${IP_COUNT}"
	exit $STATE_CRITICAL
elif [[ "$COMPARE_WARNING" -eq 1 ]]; then
	echo "WARNING - average connections is ${AVG}, total connections: ${TOTAL_CONNS}, IP count: ${IP_COUNT}, min per IP: ${max} | avg_conns=${AVG};${WARNING};${CRITICAL};0; total_conns=${TOTAL_CONNS} ip_count=${IP_COUNT}"
	exit $STATE_WARNING
else
	echo "OK - average connections is ${AVG}, total connections: ${TOTAL_CONNS}, IP count: ${IP_COUNT}, min per IP: ${max} | avg_conns=${AVG};${WARNING};${CRITICAL};0; total_conns=${TOTAL_CONNS} ip_count=${IP_COUNT}"
	exit $STATE_OK
fi