fail2ban/config/filter.d/scanlogd.conf

# Fail2Ban filter for port scans detected by scanlogd

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = scanlogd

failregex =  ^%(__prefix_line)s<HOST>\ to\ [\.:0-9a-f]+\ ports\ [\ \.,0-9]+,\ f.......,\ TOS\ [0-9]+,\ TTL\ [0-9]+\ \@[0-9]{1,2}:[0-9]{2}:[0-9]{2}$

ignoreregex =

# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
config/: Add support for filtering out detected port scans via scanlogd. 4 years ago			`# Fail2Ban filter for port scans detected by scanlogd`

			`[INCLUDES]`

			`# Read common prefixes. If any customizations available -- read them from`
			`# common.local`
			`before = common.conf`

			`[Definition]`

			`_daemon = scanlogd`

			`failregex = ^%(__prefix_line)s<HOST>\ to\ [\.:0-9a-f]+\ ports\ [\ \.,0-9]+,\ f.......,\ TOS\ [0-9]+,\ TTL\ [0-9]+\ \@[0-9]{1,2}:[0-9]{2}:[0-9]{2}$`

			`ignoreregex =`

			`# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>`