It should trigger fail2ban, that's for sure.
Alerting is useless, with the volume of automated exploits attempted.
Alerting is useless, with the volume of automated exploits attempted.
But people here are going to explain that fail2ban is security theater...
This is all a matter of threat and risk management. If you know what you are doing then fail2ban or portknocking is another layer on your security.
Security theater in my opinion is something else: nonsense password policies, hiding your SSID, whitelisting MACs, ...