From 9a997b2a5093b663fe2c3834771d1ce5e6593d47 Mon Sep 17 00:00:00 2001
From: Sefinek <contact@sefinek.net>
Date: Fri, 20 Dec 2024 19:39:10 +0100
Subject: [PATCH] UDP traffic will no longer be reported (in accordance with
 AbuseIPDB policy) #3

---
 reporter.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/reporter.sh b/reporter.sh
index db67649..e572710 100644
--- a/reporter.sh
+++ b/reporter.sh
@@ -190,6 +190,14 @@ process_log_line() {
         len=$(echo "$line" | grep -oP 'LEN=\K[^\s]+')
         tos=$(echo "$line" | grep -oP 'TOS=\K[^\s]+')
 
+        # Report MUST NOT be of an attack where the source address is likely spoofed i.e. SYN floods and UDP floods.
+        # TCP connections can only be reported if they complete the three-way handshake. UDP connections cannot be reported.
+        # More: https://www.abuseipdb.com/reporting-policy
+        if [[ "$proto" == "UDP" ]]; then
+            log "INFO" "Skipping UDP traffic: SRC=$src_ip DPT=$dpt"
+            return
+        fi
+
         if is_ip_reported_recently "$src_ip"; then
             log "INFO" "IP $src_ip ($proto) was reported recently"
             return