[FW1] Can I create a dynamic BLOCK based on "sensor IP's"

[Patrick Coomans]

Hi,     I would like to create some fake "sensor" IP addresses on a FW1 and create a dynamic BLOCK on the source IP address of those who try to connect to specific ports on this address.   E.g. I would like to add an address and listen for FTP connect attempts.  If an attempt is logged, I would like FW1 to execute a BLOCK on the source IP address.   I know that I've seen some kind of scripting in the past to accomplish this, but I cannot find any references to them anymore.   All suggestions are welcome!     Thx, Patrick