[back from the grave] paul@vix.com (Paul A Vixie) writes:

Filtering packets based on source address makes Ciscos go way slow on every packet. Filtering based on destination address makes Ciscos go very fast on most packets and a little slower on SYN-ACKs.

While I agree with what you're trying to do, your statement about filtering packets on source addresses is not correct. It's exactly the same hit. Paul -- The streets will flow with the blood of non-believers.