Detect brute-force IPs in auth.log

Challenge

Detect brute-force source IPs in an auth log — the simplest brute-force detector and the heart of every SOC routine.

Task

Implement int detect_brute_force(const char *log, int threshold) that returns the number of distinct source IPs whose failure count is at least threshold.

Input

• log: a NUL-terminated, newline-separated auth-log buffer baked into the harness. Each Failed password ... from <ip> port ... line is one failure for that IP. Accepted lines are not failures.
• threshold: the minimum failure count for an IP to be flagged (compared with >=).

Output

Returns a non-negative int: the count of distinct IPs meeting the threshold.

Example

""                                        threshold 1 -> 0
three "Failed" from 192.0.2.7             threshold 3 -> 1
same                                      threshold 4 -> 0
mix of "Failed" from two IPs + "Accepted" threshold 1 -> 2

Edge cases

• Empty log returns 0.
• A threshold higher than any IP's count returns 0.
• The same IP across many lines counts once toward the result.

Rules

• The IP is the token after from and before port.
• Skip Accepted lines entirely.
• Pure string parsing on the static buffer. A small fixed-size table (<= 128 entries) is fine; no allocation.

Why this matters

The simplest brute-force detector you'll ever write — and the heart of every SOC routine.

Input format

A NUL-terminated multi-line log buffer + an integer threshold.

Output format

Non-negative int — count of IPs over threshold.

Constraints

No allocation. Small fixed-size table is fine (≤128 entries).

Starter code

#include <stddef.h>
#include <string.h>

int detect_brute_force(const char *log, int threshold) {
    /* TODO */
    (void)log; (void)threshold;
    return 0;
}

Common mistakes

Counting Accepted lines. Adding the same IP twice. Missing the from → IP → port parsing pattern.

Edge cases to handle

Empty log. Threshold higher than any IP's count. Same IP across many lines.

Complexity

O(n × m) worst-case where m is the number of distinct IPs (small in practice).

Background lessons

• Detect failed-login bursts in auth.log

Up next

• Score a password against a policy struct