-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Michelle Konzack wrote:

You're seeing 200 hits a second! From the same ip addresses or different ones all the time?

Since no single ip address should be hitting your server that often, you could rate limit incoming connections to your port 25 with iptables:

iptables -A INPUT -p tcp --dport 25 -m state --state NEW \ -m recent --set iptables -A INPUT -p tcp --dport 25 -m state --state NEW \ -m recent --update --seconds 60 --hitcount 10 -j DROP

If it sees more than '--hitcount' new connections in '--seconds' number of seconds, it will start dropping connections, until there are less than '--hitcount' new connections in '--seconds' number of seconds.

This doesn't know whether connections are authenticated or not, obviously. It just keeps track of how often new connections come in from individual ip addresses and drops any that are over the limit.

HTH Bonne chance!

iD8DBQFG/Qs5GfIHDMaiC9cRAtoPAJ0bQECDPK0z2+2u+H8FCsKiRkxp7ACfeDqG GQSGriM6ecaoiKSJWAsZHs8= =IsY9 -----END PGP SIGNATURE-----