We jump to this chain for new SSH connections:

#-A Ssh -m recent --rcheck --hitcount 10 --seconds 60 --name SSH -m limit --limit-burst 1 -j LOG --log-prefix "SSH attack: "
-A Ssh -m recent --update --hitcount 10 --seconds 60 --name SSH -j DROP
-A Ssh -m recent --set --name SSH -j ACCEPT

We have tried 2, 4 and 10 (Dr. Pepper) for the hitcount. Under all settings we're having legitimate SSH connections blocked. I tried commenting out the LOG line as you can see; still having problems. Ideas?

I think two of the following were legitimate users:

#  cat /proc/net/ipt_recent/SSH
src=62.195.53.146 ttl: 49 last_seen: 3055027698 oldest_pkt: 1 last_pkts: 3055027698
src=140.211.114.202 ttl: 113 last_seen: 3055558577 oldest_pkt: 1 last_pkts: 3055558577
src=216.120.255.26 ttl: 54 last_seen: 3059366773 oldest_pkt: 8 last_pkts: 3058585786, 3058585786, 3058585787, 3058588783, 303
src=137.205.71.218 ttl: 113 last_seen: 3064586478 oldest_pkt: 1 last_pkts: 3064586478
src=71.193.245.122 ttl: 45 last_seen: 3077846920 oldest_pkt: 10 last_pkts: 3066177524, 3077801852, 3077803064, 3077807893, 30
src=209.216.253.17 ttl: 54 last_seen: 3067437583 oldest_pkt: 5 last_pkts: 3067434603, 3067434603, 3067434603, 3067437583, 303
src=80.20.5.39 ttl: 50 last_seen: 3076848217 oldest_pkt: 8 last_pkts: 3070547955, 3070548069, 3070548651, 3070551067, 3070557
src=61.129.115.94 ttl: 52 last_seen: 3080820003 oldest_pkt: 8 last_pkts: 3070675597, 3070675597, 3070675601, 3070678596, 3073
src=200.201.180.58 ttl: 55 last_seen: 3083993623 oldest_pkt: 3 last_pkts: 3083993618, 3083993619, 3083993623
src=194.27.200.2 ttl: 55 last_seen: 3106669586 oldest_pkt: 8 last_pkts: 3106537971, 3106537971, 3106537972, 3106540915, 31066
src=220.247.205.60 ttl: 48 last_seen: 3127216819 oldest_pkt: 5 last_pkts: 3127107586, 3127110581, 3127110634, 3127211139, 319