I decided to give PSAD a spin on the Linode since I've never tried it before. I'm impressed at the features of it. I've been running it maybe a bit over a month. I get alerts whenever PSAD detects a scan or when it logs and drops specific traffic, so I'm aware of what's going on (instead of having to check my firewall logs). One of the main reasons I decided to give PSAD a spin is because my fwanalog setup stopped working due to a code bug that affects Ubuntu v12.04.
One of the things I've been doing (I used to do this in the past) is I send my dropped logs to Dshield.org (or isc.sans.org). One of PSAD's features enables me to send the logs, vs. using third-party or Dshield apps.
I noticed when sending my logs that I'm catching bidirectional traffic and my server IP is being flagged as a result. Why? I was blocking 118.0.0.0/8 (a large segment of APAC). I was not only blocking but sending resets, which requires my firewall to send resets when means my IP is talking back, even though it's ending the session. My firewall logs it as a drop. To fix this, I just configured the firewall to drop the traffic, although I could've just changed the --log-prefix tag to something other than DROP, which by default PSAD looks for. I'll monitor the Dshield logs to see how PSAD is now reporting.
