Now I want to block an ip (or drop packets sourcing from an ip) if the ip hits my host for say 5 request in a min. How to do so? Can you point me to what tool or command to read about in regard to the stated issue?
After searching, I came across iptables with -m limit module. But this doesn't consider IP address. Meaning, if I set the limit to 5 on port 22 for 5 hits per 60 seconds, this will prevent connections if 5 hits hit the server regardless the source ip (whether that a single ip or 5 different machines). I also came across tc to shape the traffic bandwidth but I wasn't sure if it's the tool I should be looking at.
Please help me out by posting links along with your solution. I always love to read more.
Thanks in advance.
UPDATE: I can't use fail2ban here as fail2ban requires the existence of date and time in some known format in the logs. This is not the case for the logs of freeswitch.