$ ipset create ssh22 hash:ip timeout 86400

-------------------

*filter
:INPUT ACCEPT [1960:479663]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2218:607501]
:SSH - [0:0]
:SSH22 - [0:0]
-A SSH -p tcp -m tcp --dport 987 -m state --state NEW -m recent --set --name ssh --mask 255.255.255.255 --rsource
-A SSH -m recent --update --seconds 300 --reap --hitcount 4 --name ssh --mask 255.255.255.255 --rsource -j DROP
-A SSH22 -p tcp --dport 22 -m state --state NEW -j SET --add-set ssh22 src
-A SSH22 -m set --match-set ssh22 src -j LOG --log-prefix "[SSH22] "
-A SSH22 -m set --match-set ssh22 src -j DROP
COMMIT

-------------------

$ ipset list
Name: ssh22
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536 timeout 86400
Size in memory: 200
References: 3
Number of entries: 0
Members: