Re: adding username to posts

> What we are discussing is filtering mail such that a count is kept of
> the number of messages sent in a day.

Where "filter" may be misleading ....
You are just "watching" -- yes ?

Why not just look at the logs ??

> His claim is I can't find out who the real user connected to a port is.

as in RFC 931 ?
Indeed, in general you cannot.
When there is an MTA involved, you almost certainly can't tell whi "sent" the
message from 931 data (it will be the mailer userid).

> Now, I am currently having a related problem. It seems my users most
> likely to bounce large messages which end up in the queue are the same
> ones that don't put a return address on their mail messages.

define "return address".

> What I want to do is to write a filter using SNMP to query the router.

"router" normally means "IP router".
Do you mean MTA ?
No use.

> I'm assuming that I can pull the IP of the connection into my filter.

Which IP connection ?
[[ I feel like I'm joining a conversation half way through. All sorts of terms
are being used in a way other than I would, so I'm lost !
]]

> Finally, the question. Does anyone have any idea what kind of overhead
> I am talking about here?

Overhead where ? Under what circumstances ?

> I'm a small site with only 2K users.

The number of users may not matter, more likley the traffic ...

> The overhead to me is going to be insignificant.

Then why ask ??

> Does anyone with large filters have a feel of how this would affect a big ISP?

What do you mean by "large filters" ?
Affect a large ISP how ?
If who used it ?

[[ Am I being very dumb today ???? ]]