Re: [Sshguard-users] sshguard not blocking proftpd & dovecot bruteforces

[Mij <mi...@bi...>]

On Jul 31, 2009, at 12:53 , Tobias Lott wrote:

>>> Jul 31 02:48:05 hostname sshguard[71965]: Offender
>>> '::ffff:CC.CC.CC.CC:6' seen 2 times.
>>>
>>> # pfctl -t sshguard -T show
>>> ::ffff:CC.CC.CC.CC
>>
>> looks good, what's wrong?
>
> The Problem is that ::ffff:CC.CC.CC.CC is not a Valid IP Address for  
> PF.
> Somehow Proftpd just puts ::ffff: in front of the real IPv4 Address so
> thats gotta be stripped off. Think I should dig up why proftpd is  
> doing
> that.

It is a valid IPv6 address (IPv4 transitional), you read it as
::ffff:cccc:cccc

I bet PF does not insert an address into a table without validating it.
If you don't see blocking applied, try checking the rule itself.