fail2ban/config/filter.d/scanlogd.conf

# Fail2Ban filter for port scans detected by scanlogd

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = scanlogd

failregex =  ^%(__prefix_line)s<ADDR>(?::<F-PORT/>)? to \S+ ports\b

ignoreregex =

# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
config/: Add support for filtering out detected port scans via scanlogd. 2021-02-25 19:13:18 +00:00			`# Fail2Ban filter for port scans detected by scanlogd`

			`[INCLUDES]`

			`# Read common prefixes. If any customizations available -- read them from`
			`# common.local`
			`before = common.conf`

			`[Definition]`

			`_daemon = scanlogd`

small amend: sport after saddr is optional format of message: saddr[:sport] to daddr [and others,] ports port[, port...], ..., flags[, TOS TOS][, TTL TTL] @HH:MM:SS 2021-04-03 21:29:16 +00:00			`failregex = ^%(__prefix_line)s<ADDR>(?::<F-PORT/>)? to \S+ ports\b`
config/: Add support for filtering out detected port scans via scanlogd. 2021-02-25 19:13:18 +00:00
			`ignoreregex =`

			`# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>`