Identifying DoS-attacked IP address(es)

if something is being attacked it'll show in the 'statically limited'
listing, trust me... this is how we do it all day, every day...

Yes as have we, however you run out of memory/list entries
quickly and when that happens CEF gets disabled and it get pretty ugly.
This is more an issue for engine 0 and 2

Hmm, this we have not seen...