The problem is, remote attacker can establish as much connections per
minute as bandwidth allows... Now, guess how inetd reacts if more than
256 connections received in one minute? It will disable service for next
10 minutes to help attack to succeed. Of cause, this is documented.
Interval is not configurable.
something like
Jul 23 15:27:10 host inetd[86]: ftp/tcp server failing (looping), service
terminated
will appear in logs... If connection is closed by attacker before
service actually starts, IP address of attacker will never be logged.
IV. Workaround