Hi Arron,

Thanks for the reply. Unfortunately using Performance Monitor doesn't work for me for various reasons. I had another attack yesterday, which consisted of the same IP trying to access a mailbox using POP. Although Dynamic Screening shows 23491 hits in a matter of an hour, the number of POP sessions for yesterday only shows 306. This is correct because the attacker never actually managed to connect to the server. My problem is that the sheer number of attempts is causing my server to slow down dramatically as it deals with the onslaught of attempted POP connections, which it then has to block every time. Performance Monitor is the right tool to address this issue, although the problem is that there is no counter that deals with Dynamic Screening. Monitoring the IMAP, SMTP and POP sessions is useless because the attacker is not connected to the server yet. To stop the attack, I block the offender on my firewall device, but in order to do this, I need to be notified somehow that an attack is in progress. So, I guess, if you can add counters for IP Screening, Host Screening and Dynamic Screening, (Total/Day and Total/Second) that would be sufficient to address the problem.

Thanks,
Charl