fail2ban does not listen on the network itself — it reads a service's log and reacts to failed-login records.
The bundle of "what to read, what to look for, what to do" is called a jail. A jail has three parts: the record source — the journal of the right service; the filter — a pattern of a refusal line, such as Failed password ... from <IP>; the action — banning the address through the firewall. For SSH the ready-made jail is called sshd. Its state is shown by fail2ban-client status sshd: how many refusals are counted (Total failed), who is banned now (Banned IP list) and which source the jail watches (Journal matches).
Key points
- fail2ban reads a service's log, catches refusals in it with a filter and bans the address through the firewall.
-
The bundle "source → filter → action" is a jail; for SSH it is called
sshd. -
A jail's state is shown by
fail2ban-client status sshd:Total failed,Banned IP list,Journal matches.