I was troubleshooting an outlook client trying to authenticate with the Mail server, and the client would time out ( it was an issue with a local outlook installation & machine firewall)
To identify if the connection was actually reaching the server I initiated a tcpdump and noticed that there was another machine that was continuously tying to access it. I do have fail2ban running on the server. However this issue is not reported on any logs (in the normal mode). This behaviour is also currently not having any impact on the system resource.
- should I just ban this IP ( it feels like a stop gap)?
- what kind of rule should i make ?