Hi Guys, Steve from Pennywize here.
Wow, my first post - but i thought i should put my $0.02 in ;-)
We have done alot of research into brute force (dictionary) attacks for our most recent release, and let me say that while it is impossible to *stop* brute force attacks, you can certainly make it so difficult for them that they get frustrated and go somewhere else. Which in the end, is a good result for you.
Pennywize V3 has some pretty sophisticated 'rate of failure' tracking which instantly (and temporarily) blocks IP's that are hammering your server with failed attempts. This is configurable both per second and per minute. It also has some pretty new technology which no other product has to fool programs like GoldenEye etc.. into *thinking* that they found a correct password when they really didnt :-) This causes most pieces of software to stop at that point.
*sigh* the other programs will copy our technology eventually (as they always have), but no-one else can offer this now.
If anyone has any questions, give me a bell directly -
oprano@pennywize.com
Steve
Pennywize.