The 'hits' variable is now loaded from central ip_data file,
which survives monitor restarts. This is the persistent lifetime
detection count we need for the adaptive threshold.
Threshold adaptation now works correctly:
- 10+ lifetime hits: threshold = 1 (auto-block any SYN activity)
- 5-9 lifetime hits: threshold = 1 (lower from 3)
- 3-4 lifetime hits: threshold = 2 (lower from 3)
- 2 lifetime hits: threshold = 2 (lower from 3)
- 1st detection: threshold = 3 (baseline)
This enables tracking IPs that probe 5-10 times over days at low levels.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
cschantz
4ea982b119