> iptables -N SSHSCAN > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSHSCAN > iptables -A SSHSCAN -m recent --set --name SSH > iptables -A SSHSCAN -m recent --update --seconds 300 --hitcount 3 --name SSH > -j DROP hey, this is awesome. we're currently filtering log files looking for multiple failed connections, then adding them to iptables for a few minutes. this is much cleaner. :) thanks. -- Spiro Harvey Knossos Networks Ltd 021-295-1923 www.knossos.net.nz