Raimo Niskanen  writes:
> What does "lsof -ni:spamd | wc -l" say during the peaks?

quoted text
> On my machine spamd ran out of sockets (about 670).

Depending on the exact properties of the traffic you may get some

mileage out of using state tracking options to limit the number of

simultaneous connections from a single host, rate of new connections

etc and creative use of overload tables.  Much like the mainly ssh

focused example at [1], only the technique is a general one and could

just as easily be applied to SMTP connections.  
[1] http://home.nuug.no/~peter/pf/en/bruteforce.html

--

Peter N. M. Hansteen, member of the first RFC 1149 implementation team

http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/

"Remember to set the evil bit on all malicious network traffic"

delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.