I think the attempt should be consecutive, in a shortest interval, like you simulating a dictionary attack.
*OLIVER JAGAPE* Senior Network Specialist, MIS Department ECE, LPIC-1 Phone : +63 82 235 5000 ext 8043 Email : oliver(dot)jagape(at)link2support.com <mailto:oliver%28dot%29jagape%28at%29link2support.com> *Link2Support, Inc.* Damosa I.T. Park, Building 1, J.P. Laurel Ave. Lanang, Davao City 8000 Philippines http://www.link2support.com <http://www.link2support.com/> This e-mail may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply e-mail and delete all copies of this message. [EMAIL PROTECTED] wrote: > I just installed Ossec in 2 windows box as [local] > But when I try to do the wrong ssh login for testing purpose if ossec will > block me. It do not block the ip for 600 seconds. > But I am getting the email alert that someone tried x number of wrong ssh > logins. > In other servers its running perfectly fine. I installed gcc gcc++ cc > compilers. > Can anyone tell me what am I doing wrong? > > Regards, > DM > > >
