[Snort-users] SYN flood detection
erek at ...577...
Fri May 10 12:02:29 EDT 2002
On Fri, 10 May 2002, Matt Kettler wrote:
> spp_portscan is intended to detect portscans, not syn floods. It's designed
> to detect numerous connections to *different* ports. A syn-flood detector
> is pretty similar in code design to spp_portscan, but detects something
> very different.
And to detect scans to the _same_ port on _different_ machines.
> perhaps a spp_synflood should be created to detect numerous connections
> period? I'd suspect you'd want different settings for the portscan and
> synflood versions anyway. (ie: 4 different ports in 3 seconds is sufficient
> to call it a portscan, but more like 400 connections to call it a synflood.)
This would really be a value that would have to be played with... But, yes--I
think it would be nice to have as a plugin. Any coder voulnteers? ;-)
More information about the Snort-users