# How to list banned IPs in fail2ban

> List banned IPs in fail2ban: status <jail>, banned, get banip --with-time, all jails at once, check one IP, and read bans from nftables, iptables or the database.
>
> Source: https://fail2ban.dev/banned-ips/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To list banned IPs in fail2ban, run `sudo fail2ban-client status <jail>` — for example `sudo fail2ban-client status sshd` — and read the `Banned IP list` line. For all jails at once, use `sudo fail2ban-client banned`. To see when each ban started and when it expires, use `sudo fail2ban-client get sshd banip --with-time`. All three read the live state of the running server.

```text
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42
```

## Show banned IPs in all jails

```text
$ sudo fail2ban-client banned
[{'sshd': ['203.0.113.42']}, {'recidive': []}]
```

```text
$ sudo fail2ban-client status --all
Status
|- Number of jail:	2
|- Jail list:	recidive, sshd
`- Status for the jails:
   |- Jail: recidive
   |  |- Filter
   |  |  |- Currently failed:	3
   |  |  |- Total failed:	3
   |  |  `- File list:	/var/log/fail2ban.log
   |  `- Actions
   |     |- Currently banned:	0
   |     |- Total banned:	0
   |     `- Banned IP list:
   `- Jail: sshd
      |- Filter
      |  |- Currently failed:	2
      |  |- Total failed:	6
      |  `- File list:	/var/log/auth.log
      `- Actions
         |- Currently banned:	0
         |- Total banned:	3
         `- Banned IP list:
```

```bash
  echo "== $j"; sudo fail2ban-client get "$j" banip
done
```

```text
$ sudo fail2ban-client get sshd banip --with-time
203.0.113.42 	2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10
192.0.2.15 	2026-10-25 18:36:14 + 3600 = 2026-10-25 19:36:14
192.0.2.16 	2026-10-25 18:36:14 + 3600 = 2026-10-25 19:36:14
```

Without `--with-time`, `get <jail> banip` prints just the addresses, separated by spaces. You can pass another separator, which is handy for one-per-line output or CSV:

```text
$ sudo fail2ban-client get sshd banip
203.0.113.42 192.0.2.15 192.0.2.16
```
sudo fail2ban-client get sshd banip ,                 # comma-separated
sudo fail2ban-client get sshd banip | tr ' ' '\n'    # one per line
```

```text
$ sudo fail2ban-client banned 203.0.113.42
[['sshd']]
```

```bash
```

## Count banned IPs

```bash
sudo fail2ban-client status sshd | grep 'Currently banned'

# currently banned, all jails
sudo fail2ban-client banned | grep -oE "'[0-9a-fA-F]*[:.][0-9a-fA-F:.]*(/[0-9]+)?'" | wc -l
```

## See banned IPs in the firewall

fail2ban's list is its *intent*. The firewall shows what is actually blocked, which is what you want when a [banned IP can still connect](/troubleshooting/not-banning/#part-2-the-ip-is-banned-but-still-connects). The commands depend on your [ban action](/config/banaction/):


#### nftables
fail2ban creates the table `inet f2b-table` with one set per jail: `addr-set-<jail>` for IPv4 and `addr6-set-<jail>` for IPv6.

```bash
sudo nft list table inet f2b-table     # every jail
```
Each jail gets its own chain, `f2b-<jail>`, with one rule per banned address.

```bash
sudo ip6tables -L f2b-sshd -n
```
`iptables-ipset` and `firewallcmd-ipset` put addresses into an ipset named `f2b-<jail>` (`f2b-<jail>6` for IPv6).

```bash
```
The rich-rule actions add one rule per address; the ipset action uses the set above.

```bash
```
```bash
```

## List banned IPs from the fail2ban database

fail2ban keeps bans in SQLite at `/var/lib/fail2ban/fail2ban.sqlite3` so it can restore them after a restart. Two tables matter:

- `bips` — one row per IP and jail with the latest ban (`ip`, `jail`, `timeofban`, `bantime`, `bancount`). This is what gets restored.
- `bans` — one row per ban event; rows older than `dbpurgeage` (default `1d`) are purged.

Install the `sqlite3` command-line tool, then:

```bash
sudo sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 \
  "SELECT jail, ip, datetime(timeofban,'unixepoch','localtime'), bantime, bancount
   FROM bips WHERE bantime < 0 OR timeofban + bantime > strftime('%s','now')
   ORDER BY timeofban;"

# most-banned IPs within the purge window
sudo sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 \
  "SELECT ip, COUNT(*) AS n FROM bans GROUP BY ip ORDER BY n DESC LIMIT 20;"
```

## Banned IP history from the log

For a longer history than the database keeps, use fail2ban's log:

```bash
sudo grep '\] Ban ' /var/log/fail2ban.log

# top 10 banned IPs across rotated logs
sudo zgrep -h '\] Ban ' /var/log/fail2ban.log* | awk '{print $NF}' | sort | uniq -c | sort -rn | head
```

To remove an address from any of these lists, see [unban an IP](/unban-ip/).

## FAQ

### How do I see banned IPs in fail2ban?

Run `sudo fail2ban-client status <jail>`, for example `sudo fail2ban-client status sshd`; the `Banned IP list` line shows every address the jail blocks. `sudo fail2ban-client banned` shows the bans of all jails, and `get <jail> banip --with-time` adds ban and expiry times.

### How do I list banned IPs in all jails?

Run `sudo fail2ban-client banned`. It returns each jail with its list of banned addresses. On fail2ban 1.1.0 and newer, `sudo fail2ban-client status --all` prints the full status block of every jail. On 1.0.x, loop over the jail names with `get <jail> banip`.

### How do I check if a specific IP is banned?

Run `sudo fail2ban-client banned <IP>`. It returns the jails banning that address, such as `[['sshd']]`, or `[[]]` if none do. To check the firewall itself, search for the address with `nft list ruleset`, `iptables -S` or `ufw status`, depending on your ban action.

### Where does fail2ban store banned IPs?

In memory while running and in the SQLite database `/var/lib/fail2ban/fail2ban.sqlite3` (table `bips` for current bans). The firewall holds the actual block rules. On restart, fail2ban reads the database and re-applies bans that haven't expired.

### Why is the banned IP list empty but Total banned is not zero?

`Total banned` counts every ban since the jail started, including ones that have already expired. `Currently banned` and the `Banned IP list` only show active bans. If bans disappear quickly, your `bantime` is short — 10 minutes in the stock `jail.conf`.