[c-nsp] SMTP "Monitoring"

[chindasvinto jones]

Take a look to logsurfer, you can log every conection with syslog and
setup logsurfer to open contexts on smtp conections per client.

regards

> Is there a way to monitor and/or alarm SMTP connections that transverse
> the FW blade in a 6509?  Specifically, can you generate some form of an
> alarm if IP address 10.1.1.1 sends more than 10 emails in a 60 second
> period etc?  This is to cut down on spam outbreaks that are caused by
> infected customers etc... We could just block that customer's IP until
> it's cleared up etc...