how to log source ip connections?

I don't think there is a way to tell how many connections they are trying and block the excess connections, since the it will decrement the counter when the connection is rejected (i.e. CLIENT_CLOSED). However, the script below (modified from yours) will generate a warning if the connections exceed the threshold.

-Shane

when RULE_INIT {
array set ::active_clients { }
array set white_client {
x.x.x.x
y.y.y.y
}
}
when CLIENT_ACCEPTED {
set client_ip [IP::remote_addr]
if { [info exists ::active_clients($client_ip)] && ![info exist ::white_client($client_ip)] } {
if {$::active_clients($client_ip) > 50 } {
incr ::active_clients($client_ip)
reject
log "Alert! $::active_clients($client_ip) connections to mysite.com from $client_ip"
return
} else {
incr ::active_clients($client_ip)
}
} else {
set ::active_clients($client_ip) 1
}
}
when CLIENT_CLOSED {
set client_ip [IP::remote_addr]
if { [info exists ::active_clients($client_ip)] && ![info exist ::white_client($client_ip)] } {
incr ::active_clients($client_ip) -1
if { $::active_clients($client_ip) <= 0 } {
unset ::active_clients($client_ip)
}
}
}