gawk "/SMTPD.* connect/ {print $6}" < /path/to/spool/sys0122.txt | sort | uniq -ic | sort /r... and if you replace that last "/r" with "/+9", you get the remote ip's sorted by ip, so you can see when a Class C of ip's is attacking you with perhaps low numbers of msgs per ip, but the number of attacks per Class C is much higher. Block the whole class C.
Len
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
