How about throttle by service at the router?
If one can get away from the one-box mindset, IMGate/postfix has very effective TCP throttler, that 421 rejects immediately as it sees a TCP connect to its port 25 for any IP that has connected more than x times in y seconds. Values that I find effective are 10 connects in 1800 seconds. This is called the anvil feature (see your anvilling MX as the one getting hammered). harvesting the anvil log info allows you to promote the IPs or ClassC from 4xx reject to 5xx local SMTP blacklisting, or router ACL.
Len
_____________________________________________________________________ http://MenAndMice.com/DNS-training : Denver; NYC; San Jose http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
