Todo:

iptables can do more than just block the given IP, it can be used to turn the attacker onto themselves. The moment an IP is considered hostile, an iptables DNAT can be used to redirect their ssh login requests to themselves. Chances are that IP will be listening because that is how their machine was infected in the first place.

An initial iptables command such as this:
iptables -I FORWARD -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
will enable support, and then
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 22 -i eth1 -j DNAT -s <IP> --to <IP>
will redirect any ssh traffic from <IP>, to <IP>.

Pros:
1. Wastes attackers time, it is their logs that are filled with failure messages.
2. The attack on the attackers machine will be successful, probably leading to the real attacker being given your IP as a penetrated machine, making it a much bigger time waster when he tries to login to your machine and fails.

Cons:
1. Relaying the login attempts wastes your bandwidth.
2. Legally it could be considered hacking.
3. Some ISPs monitor outgoing ssh connection requests, a high frequency of outgoing connections suggests you've been hacked. ISPs have been known to telephone the source of sshd brute force attacks (ie. their customers) and suggest they've been hacked.

