[K12OSN] howto temporary block badguy?

[dale]

Hello,
	I would like to temporarily block various machines that connect to my 
server based on certain events.  For instance, if a machine connects to 
my mail server and sends a virus 3 times in a 15 minute window, block 
that machine via iptables for 24 hours.  The same goes for machines that 
look for IIS exploits, open ports, etc.
Does anyone have a pointer to a project similar to this?
Is there a good reason not to block a machine?
Would you adjust occurance/time trigger or block time?


Thanks,

Dale