iptables -N SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

server:/usr/src/linux# iptables -L -v
Chain INPUT (policy ACCEPT 2164 packets, 357K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0            tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW recent: SET name: SSH side: source
    0     0 SSH_WHITELIST  tcp  --  any    any     anywhere         anywhere            tcp dpt:ssh state NEW
    0     0 ULOG       tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source ULOG copy_range 0 nlgroup 1 prefix `SSH_brute_force' queue_threshold 1
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 2522 packets, 316K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain SSH_WHITELIST (1 references)
 pkts bytes target     prot opt in     out     source               destination