Thought this might be of interest . . . dynamic updating of PF ruleset based on suspicious calls to the www server: http://www.benzedrine.cx/pf/msg01273.html It's from Feb 2003 and was in CURRENT, so I'm sure it's there now. . .