> So... I am looking for a snort rule to flag abusive clients. Let's call > anybody who sets their time more than 10 times in 10 seconds abusive. Once
I'll let others comment on the rest, but you might want to change that to 30 times in 30 seconds or something similar. Well meaning clients might have the iburst parameter set which does a quick 8 polls on startup and would come dangerously close to being blocked for not uncommon usage. sjm _______________________________________________ timekeepers mailing list [email protected] https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
