SpamBlock

SpamBlock counts attempts to establish a connection on port 25/tcp via tcpdump. When a host exceeds the allowed number of attempts per unit of time, it is added to a corresponding ipfw table and email notification is sent. Spamblock currently supports ipfw only, but it can be easily adapted for any firewall and OS. It can also be configured to watch multiple ports to prevent Telnet and SSH attacks in addition to SMTP.