Trying to figure a good way to do some fancy rate limiting. What I'd
like to do is test a rate limit without adding to the count.
Here's the situation. I get a dictionary attack from an IP address. So
what I want to do is count bad recipients so that every time I get a bad
recitient from an IP address I add 1 to the count.
In a separate ACL I want to look at the count and if it is greater than
my limit I want to do a defer. But I don't want the defer test to affect
the count. But I'm not seeing a way to test a count without adding to
the count.
The idea here is to have one ACL affect the count but a different ACL to
test the cout without affecting it.
