A picture is worth a thousand words:
I blocked him/her last night. He/she hit again early this morning, but got rejected (not blocked). My sensor will log even if the attacks don't pass (picture it as an external IDS, although it really isn't). I sooo wish I messed with tarpits. I could rate-limit, though. I'll think about that.
UPDATE:
myNetWatchman
