7477 shaares
Whenever you end-up with a large number of banned IP's in fail2ban you might want to know if there are multiple IP's banned from the same subnet. This scripts groups all banned IP's into /24 subnets.
By default the script returns all subnets with 10 or more IP's banned by fail2ban. You can change the group size either by adapting this script or using the --groupsize= parameter.
Example:
sudo ./fail2ban_subnets.sh --groupsize=15