neil gardner wrote:

Um, no false positives? doesn't that mean you manually inspect all your logs of dropped connections? Doesn't, by extension, that mean you might as well let all the stuff through and check them at the client end? :-)

Yes, I do check the logs, which is a lot easier than it may appear. No, it doesn't mean I might as well let the stuff through... -- Juha