only keep track of individual connections for 1 minute.
only keep track of individual connections for 1 minute.

A machine spamming wouldn't have the same connection open for very long.
Even if it does, if we see more rejects after 1 minute, it doesn't hurt to
count them.  This would esentially count '1 rejection per connection per
minute', instead of 'at most 1 rejection per connection'

JustinAzoff/bro_scripts,JustinAzoff/bro_scripts