I have written a Perl module to access to Dshield data. The idea behind that is to do some special reactions to stuff dshield sees for Picviz, such as coloring lines in red it they match.

To use the class you simply tell perl to use the class, create a new object like this:

use Picviz::Dshield;
$dshield = Picviz::Dshield->new();

This will actually download the list of IP and port trends from my daily updated wallinfire.net mirror (to avoid bothering dshield.org).

Then, to check wether an IP match a dshield data or not, you can call:

if ($dshield->ip_check("192.168.1.42")) {
        print "The IP address is in the Dshield database";
} else {
        print "The IP address is not in the Dshield database";
}

So without any knowledge of how dshield works etc, you can easily embed and script with perl a connection to it.

After that, I modified the ssh authentication script to see wether my server was attacked by IP addresses in Dshield, and I produced to following graph:
As you can see, there is a red line, showing that I've got SSH scanned by one IP address at different times, with (hopefully!) failed authentication, on the root login.

All this is available in the tools/ directory of the latest Picviz trunk. To install the Dshield perl module, simply type:

$ cd trunk/tools/Picviz-Dshield
$ perl Makefile.PL
$ make
$ sudo make install

and you can test your ssh connections using the ssh connection script in tools/auth/ :

$ perl ssh-authdshielded2pcv.pl /var/log/auth.log > auth.pcv
$ picviz-gui auth.pcv