pop_connections: table[conn_id] of pop3_session_info
This table contains all active POP3-sessions indexed by their Connection IDs.
As soon as the TCP Connection terminates or expires, they are deleted.
pop_connection_weirds: table[addr] of count &default=0 &create_expire = 5 mins
This table contains all the POP3-session originators for which unexpected behavior was recorded.
error_threshold: count = 3
This variable contains a threshold for the maximum number of negative status
indicators per originator received from a server. It is used for recognizing
potential abuses, e.g., trial and error password guessing attacks.
ignore_commands: set[string]
Set of commands to ignore while generating the log file.