Reverse of rate limiting?

[Eddie Kuns]

Is there an option to trigger a rule only when you reach the limit of a
rate limit?  Basically, I wonder if there is a way to log only when you
have reached a rate limit ... so if you rate limit SYNs to detect SYN
floods, you can get some idea if you are getting SYN flooded.

Just curious.

                     Eddie

-- 
  Eddie Kuns  |  Home: ekuns@kilroy.chi.il.us
--------------/  URL:  http://www.physics.rutgers.edu/~ekuns/
  "Ah, savory cheese puffs, made inedible by time and fate."  -- The
Tick