One of the things that you usually want to do with MTAs is have somelimit on how many things that they'll try to do at once. This isespecially important if, like us, you allow users to run programs fromtheir .forward s; people do every so often have runaway programs, orjust programs that sit there endlessly (trying to get a lockfile, forexample).

Unfortunately, Exim only has limited support for load limiting. Whatyou really want to do is limit the number of

Back in DualIdentityIsolation , I described how I set up a dualidentity machine so that it had isolatedinterfaces . In it I wrote:

Alas, I am now left with a mystery: according to the policy routingrules, it looks like a packet from IP1 to an address on that subnetshould get routed via the gateway (and similarly for the othernetworks), [....]

You know what? I should have paid more attention to the mystery,because as it turns out such packets were

Here is a gotcha about reading tcpdump output that recent events havebeen tattooing on my forehead:

The only sure way to tell whether a packet is going to your gatewayor to something on the local network is to look at the destinationEthernet address.

To put it another way: a packet being sent to your network's gatewaydoes not have the gateway's IP address in it. Thus, reading tcpdump output without Ethernet addresses is not really telling you whether apacket was really sent to your gateway or whether