how does vthrottle work? monitors 3 parts of mail transaction connect HELO/EHLO mail from keeps a list of entries enforces a minimum interval between observations assumes that normal hosts will send mail slowly expects bad hosts (worm? spam?) to send mail rapidly idea from m williamson, hp uk