I have been able to set up a decoder and rules to monitor the length of time a spammer is caught in a tarpit (the log entry is shown at the end of this post). The times vary from 3 to 3600 seconds. I would like to take an action to completely block spammers below a fixed threshold (say 10 seconds) but I can't figure out to test this condition.
Any suggestions? If not, being able to test for a variable =>< to a value would be a great feature to add. ----------------------------------------------------- Jan 24 09:16:45 mxgf2 spamd[23928]: 80.54.174.229: disconnected after 18 seconds.
