while(1): time.sleep(args.delay) line=sshFile.readline() if line: if "sshd" in line and "closed" in line and "preauth" in line: srcIP=line.split()[8] print(srcIP) raiseAlert(relay) sendAlert(args.server, srcIP) line=iptablesFile.readline() if line: if "UDP" in line or "TCP" in line: for words in line.split(): if "SRC" in words: srcIP=words.split('=')[1] if "DPT" in words: dPort=words.split('=')[1] #count the number of ports keyed by src IP if srcIP: print("srcIP: {} dPort {}".format(srcIP, dPort)) if srcIP not in srcIPs: srcIPs[srcIP] = 1 else: srcIPs[srcIP] += 1 if srcIPs[srcIP] == 4: print("alert") raiseAlert(relay) sendAlert(args.server, srcIP) srcIPs[srcIP] = 0 srcIP = None