http://www.sosresearch.org/publications/ISTAS02honeypots.PDF

Stop thinking about attacking back. If you have a firewall, you should have their IP in your logs. From there you can block and report...