Peter wrote:
You could try limiting at firewall level. Probably this solution is not
practical for a high-volume system; but at home, I use pf, and have a
perl script monitoring the firewall log. A pf table is either empty, or
is loaded with '0/0' (ie catch-all) by this script depending on the port
25 connection history. Said table is used to block incoming smtp
connections. There's a prior pf rule to allow "friendly" connections
irrespective. Stops floods dead, even if spread across a number of
machines. Downside is that you'll delay mail from unlisted but
nevertheless kosher machines, but you can't have it all ways :-)


--
Mike Scott (unet <at> scottsonline.org.uk)
Harlow Essex England