Re: [SSHGuard-users] Portscanners

[Jos C. <ssh...@cl...>]

On 14-10-2018 15:43, Jim Seymour wrote:
> Can sshguard do that? That would be pretty sophisticated rule
> interpretation.

If the same IP address tries to connect 60 times in a minute there is 
definitely more going on than just a trial on error.

CONNECT and DISCONNECT is a logic response to such 'initiatives'. In 
this case it is all about the number of tries per minute rather than the 
log display this causes.

 > Personally, I wouldn't worry about it.


-- With both feed on the ground you will never make a step forward