#!/bin/bash
#
# Peter Kiem          .^.   | E-Mail    : <zordah@zordah.net>
# Zordah IT           /V\   | Mobile    : +61 0414 724 766
# IT Consultancy &  /(   )\ | WWW       : www.zordah.net
# Internet Hosting   ^^-^^  | ICQ       : "Zordah" 866661
# 

CURRLOG=/var/log/fail2ban.log
LASTLOG=/var/log/fail2ban.log.1

cat $LASTLOG $CURRLOG |  grep " WARNING \[ptr\] Ban" | cut -d " " -f 7 | sort | uniq -c | awk '

BEGIN {
  print("IP  Backscatter rejections in the last 2 fail2ban logs");
  print("");
  print("# Rejects     IP Address");
  print("=========     ==========");
  lastsubnet = "";
  rejects = 0;
}

{
  split($2, octet, ".");
  subnet = octet[1] "." octet[2] "." octet[3];
  if (subnet != lastsubnet) {
    if (rejects > 1) {
      for (Loop = 1; Loop < ipindex; Loop++) {
        printf("%9d     %s\n", RejectCount[Loop], IPAddress[Loop]);
      }
      printf("\n");
    }
    lastsubnet = subnet;
    rejects = 0;
    ipindex = 1;
  }
  RejectCount[ipindex] = $1;
  IPAddress[ipindex] = $2;
  rejects += $1;
  ipindex++;
}

END {
  if (rejects > 1) {
    for (Loop = 1; Loop < ipindex; Loop++) {
      printf("%9d     %s\n", RejectCount[Loop], IPAddress[Loop], reverse_dns[Loop]);
    }
  }
}
' | mail -s "SMTP rejected IP addresses" root

exit 0