Tracking foreign ssh connections with PORT

 
Den 03-01-2017 11:15, Alessandro Tinivelli skrev: 

Hi all, I was
trying to setup an alert when a server has established SSH connections
with a "foreign" remote IP (i.e. not beginning with 192.168).

HOST=host01 

PORT "LOCAL=%([.:]22)$" "REMOTE=%^(?!(192.168)).+"
state=ESTABLISHED MAX=0 COLOR=red TRACK=SSH_fconn "TEXT=SSH foreign
connections"

Neat, I like that :-) 
Regards,
Henrik