sshdfilter and ipfw - why are my rules flushed so often?
Change /etc/sshdfilterrc to add the rules to /etc/ipfilter/ipfw.conf. This file is imported when the flush is executed. Disadvantage is that this file has to be maintained....

This prevents the blocks staying in bit heaven when the flush comes along because this file is read after the flush is executed.

edit: on request added changes I made in /etc/sshdfilterrc

firewalladd='/sbin/ipfw add $idx deny all from $ip to any in; echo add $idx deny all from $ip to any in &gt;&gt; /etc/ipfilter/ipfw.conf;echo +`date` $ip &gt;&gt;/etc/ipfilter/sshdfilter_block.log'
firewalldel='/sbin/ipfw del $idx deny all from $ip to any in;grep -v " $ip "&gt;/tmp/ipfw.conf;mv /tmp/ipfw.conf /etc/ipfilter/ipfw.conf;echo -`date` $ip &gt;&gt;/etc/ipfilter/sshdfilter_block.log'


this takes care of the block and the block Cancel actions, including some block.log to see when and how long an ip has been blocked.