Security Focus have a recent article analyzing SSH attacks using a HoneyNet.

From the article:
Malicious SSH login attempts have been appearing in some administrators' logs for several years. This article revisits the use of honeypots to analyze malicious SSH login attempts and see what can be learned about this activity. The article then offers recommendations on how to secure one's system against these attacks.

My understanding of the law on this (IANAL) is that it is legal to rattle the doorknob, but not to pass over the threshold. The comparable/analogous ethics question is: Should you wander around the neighborhood rattling doorknobs and checking windows to see if any are unlocked?

If you find someone rattling your doorknob do you have a right to interrogate them as to who they are and what they are doing? Similarly, do you have the ethical responsibility to do so?

In broad terms, I think the answer is yes. We should be able to counter-scan specific targets to gain knowledge of who they are and what they might be up to. This falls within the duty to protect. What we cannot do is counter-attack.

This, of course, leaves an awful lot of gray area. Some scanning methods (most of the more useful ones) include automated testing for exploit vulnerability, which essentially means trying the exploit with an inert payload. That's a bit like finding the door unlocked and instead of stealing something, leaving a Post-It note that says "Your door was unlocked." It may be ethically sound, but it is legally dubious (which presents its own ethical problems) and may only be defensible if you can prove intent. Unfortunately, both in the real world and even more so in the digital world, it is incredibly difficult to establish intent until it is too late. With the state of current law related to digital intrusion your actions are assumed to imply malicious intent.

Now the ethics question is: given the duty to protect, can we justify actions which may create legal exposure? Probably not. Tread lightly.