Snort - rules that stop mulitple password attempts?

[louis-m]

Hi,
I have an alix board so obviously want to keep my snort rules down to miminal. Over the last couple of weeks, my mail server has been under attack from spammers trying to guess user passwords etc, sometimes with 1000 attempts within a few minutes. i've added the ip's to a spam griup alias on pfsense which has cured the issue.
but, i was wondering if snort has any sort of rule that detects multiple password attempts in quich sucession and then blocks the ip?

[g4m3c4ck]

If you are running a linux server the fail2ban package does this