Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a service-specific (SSH, FTP etc.) threshold value, there probably was an port scan or failed login from that source IP address.
Does anyone have experience with this or is there an alternative to establish a centralized brute force detection. It's about protecting a few hundred Linux hosts running different services accessible from the internet (SSH, FTP, HTTP, SMTP, IMAP, POP3).
Fail2ban is already in use but a centralized solution should also be installed.