1. How are you figuring the source country? If you're looking at the ip in the handshake and comparing this to a db of ip / country, you're only looking at half of the story. If you're a bit smarter and have a list of border routers that country owns and are looking at that for the source country, this is probably better.
2. You didn't specify in simple t> On Fri, 05 Aug 2011 12:29:02 +0000, Walter Hurry wrote:
>> More out of curiosity than paranoia, I have carried out a small
>> geographical analysis of rejected "intrusion attempts" at my home router
> Sorry for the formatting, but I think it's just about legible, so I won't
> pollute the list by reposting.
> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact email@example.com
> Archive: firstname.lastname@example.org">http://email@example.com