I see the following pattern in every 2-3 sec, for several minutes in syslog:

Shorewall:net2fw:DROP:IN=eth0 OUT= MAC=aa:bb:cc:dd:ee:ff:gg:hh:ii:jj:kk:ll:mm:nn SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=12746 DF PROTO=TCP SPT=41611 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0

where values at ID and SPT are different in each line.The server is Debian 6.0, with shorewall and fail2ban.

How can I narrow down what is going on and use fail2ban and shorewall to better block this?

  • Looks like tcpdump output, but what the reason of this message i don't know. Dec 19, 2012 at 9:37
  • 2
    That's a connection attempt to port 22 (DPT= destination port, SYN = connection establishment attempt) on your machine (SSH).
    – Mat
    Dec 19, 2012 at 12:28

1 Answer 1


My solution ended up at this Fail2ban filter:

failregex = DROP:IN=eth0 OUT= MAC=[a-zA-F0-9:]+ SRC=<HOST> DST=([0-9]{1,3}\.?){4} LEN=
            DROP:IN=eth0 OUT=vmbr0 SRC=<HOST> DST=([0-9]{1,3}\.?){4} LEN=

added to /etc/fail2ban/filter.d/sshd-ddos.conf

It bans these requests on ssh port.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .