>Eventually all the "bad" customers end up with the same ISP, then >filtering is as easy as running loose uRPF and filtering on their AS on input. And that's why we can all safely dump anything from aol.com into /dev/null, right? ;) Rob Nelson ronelson at vt.edu