parse the auth.log and optionally "returns the favor" with a portscan