I think the log SnR point is a great one. Debugging aside, if you're able to filter out the "obviously malicious" traffic, any more sophisticated attacks will b

I think the log SnR point is a great one. Debugging aside, if you're able to filter out the "obviously malicious" traffic, any more sophisticated attacks will be easier to spot (or at the very least, analyse after-the-fact).