Patrick von der Hagen wrote:
> However, the key is "average of mails/timeunit .... significant
> derivation". I don't want to have fixed limits but consider keeping
> several values for a given IP, like average values, maximum values, etc.
> and them do some calculations wheter the current rate "seems to be
> strange". Some kind of "self-learning-method", automatically calculating
> the limits when to take action.
What I've done so far is to run two ratelimit clauses, by IP, one on
a two-hour average and one on a seven-day. Then I calculate the ratio.
So far I'm only logging, but the intent is to let off alarm emails
and block, once a significant unbalance is noted. So that's my
version of your self-learning method..... I do, as you note,
run separate info for daytime/night-and-weekends (and, boy,
calculating that is a pain).
I'm leaning towards a ratio of 10:1 being significant, FWIW.
Cheers,
Jeremy
