[c-nsp] SMTP "Monitoring"

[Paul Stewart]

Hi there...

Is there a way to monitor and/or alarm SMTP connections that transverse
the FW blade in a 6509?  Specifically, can you generate some form of an
alarm if IP address 10.1.1.1 sends more than 10 emails in a 60 second
period etc?  This is to cut down on spam outbreaks that are caused by
infected customers etc... We could just block that customer's IP until
it's cleared up etc...

Thanks,

Paul Stewart
Network Administrator
Nexicom Inc.
http://www.nexicom.net/