auto-blackholing/blacklisting on multiple hacking attempts

[John .]

Hi,

I'm running freebsd 7-RELEASE

I see this, for example, in my auth log:

May 15 02:00:39 www sshd[9180]: Invalid user web from 201.18.232.30
May 15 02:00:41 www sshd[9182]: Invalid user web from 201.18.232.30
May 15 02:00:43 www sshd[9184]: Invalid user web from 201.18.232.30
May 15 02:00:45 www sshd[9186]: Invalid user web from 201.18.232.30
May 15 02:00:48 www sshd[9188]: Invalid user web from 201.18.232.30
May 15 02:00:50 www sshd[9190]: Invalid user web from 201.18.232.30
May 15 02:00:52 www sshd[9192]: Invalid user web from 201.18.232.30
May 15 02:00:54 www sshd[9194]: Invalid user web from 201.18.232.30
May 15 02:00:56 www sshd[9196]: Invalid user web from 201.18.232.30
May 15 02:00:58 www sshd[9198]: Invalid user web from 201.18.232.30
May 15 02:01:00 www sshd[9200]: Invalid user web from 201.18.232.30
May 15 02:01:02 www sshd[9205]: Invalid user web from 201.18.232.30
May 15 02:01:04 www sshd[9207]: Invalid user account from 201.18.232.30
May 15 02:01:06 www sshd[9209]: Invalid user account from 201.18.232.30
May 15 02:01:08 www sshd[9211]: Invalid user account from 201.18.232.30
May 15 02:01:10 www sshd[9213]: Invalid user account from 201.18.232.30
May 15 02:01:12 www sshd[9218]: Invalid user account from 201.18.232.30
May 15 02:01:14 www sshd[9220]: Invalid user account from 201.18.232.30
May 15 02:01:39 www sshd[9244]: Invalid user apache from 201.18.232.30
May 15 02:01:41 www sshd[9246]: Invalid user apache from 201.18.232.30
May 15 02:01:43 www sshd[9248]: Invalid user apache from 201.18.232.30
May 15 02:01:45 www sshd[9250]: Invalid user apache from 201.18.232.30
May 15 02:01:47 www sshd[9252]: Invalid user apache from 201.18.232.30

I'd like it to be so that if an IP tries to connect to sshd more than
once in a 30 second period, that they are immediately blackholed.
Should I be using pf for this or would it be done better in some other
utility?

cheers

-- 
John