[Snort-users] SYN flood detection

Erek Adams erek at ...577...
Fri May 10 12:02:29 EDT 2002

On Fri, 10 May 2002, Matt Kettler wrote:

> spp_portscan is intended to detect portscans, not syn floods. It's designed
> to detect numerous connections to *different* ports. A syn-flood detector
> is pretty similar in code design to spp_portscan, but detects something
> very different.

And to detect scans to the _same_ port on _different_ machines.

> perhaps a spp_synflood should be created to detect numerous connections
> period? I'd suspect you'd want different settings for the portscan and
> synflood versions anyway. (ie: 4 different ports in 3 seconds is sufficient
> to call it a portscan, but more like 400 connections to call it a synflood.)

This would really be a value that would have to be played with...  But, yes--I
think it would be nice to have as a plugin.  Any coder voulnteers?  ;-)

Erek Adams

More information about the Snort-users mailing list