Hi Klaus, first, the pike module will count the IP source only for the requests called with pike_check_req(). There is no multiple counters support - only one. so, from script you can filter what requests you want to count. That's all you need to do in order to use it. regarding the configuration, you have three parameters: sampling time unit (S), request density per unit (N) and removed latency (L). In words: the alarm will be trigger if you get more than N request per S seconds. The alarm will be removed if no other request is received in L seconds. So, in your case, try: modparam("pike", "sampling_time_unit", 4) modparam("pike", "reqs_density_per_unit", 2) and if (is_method("REGISTER") && !pike_check_req()) { log("..."); exit; } regards, bogdan Klaus Darilion wrote: