My portsentry keeps doing this:

Sep 18 00:01:01 www portsentry[24770]: attackalert: UDP scan from host: 192.168.0.1/192.168.0.1 to UDP port: 68
Sep 18 00:01:01 www portsentry[24770]: attackalert: Host: 192.168.0.1/192.168.0.1 is already blocked Ignoring
Sep 18 00:01:01 www portsentry[24770]: attackalert: UDP scan from host: 192.168.120.61/192.168.120.61 to UDP port: 68
Sep 18 00:01:01 www portsentry[24770]: attackalert: Host: 192.168.120.61/192.168.120.61 is already blocked Ignoring
Sep 18 00:01:01 www portsentry[24770]: attackalert: UDP scan from host: 192.168.120.61/192.168.120.61 to UDP port: 68
Sep 18 00:01:01 www portsentry[24770]: attackalert: Host: 192.168.120.61/192.168.120.61 is already blocked Ignoring
Sep 18 00:01:02 www portsentry[24770]: attackalert: UDP scan from host: 192.168.120.61/192.168.120.61 to UDP port: 68

How do I drop those guys permanently and what else can I do. Cause this is starting to get really annoying.

Please advice.

Robbert

You could:

1. Put them into your firewall rules so they're alwas there and then add them to your portsentry.ignore file so it doesn't keep catching them.

2. Double check to make sure they're in your hosts.deny file and add them to your portsentry.ignore.