[Snort-users] [Q] thresholding: to throttle flood of alerts
vk77de at ...14012...
Thu Oct 16 11:07:10 EDT 2008
That's probably it.
99% of them come from different sources.
It was not myself that wrote the rule.
Got it with the oinkmaster.
On Thu, Oct 16, 2008 at 2:41 PM, Markus Lude <markus.lude at ...348...> wrote:
> On Thu, Oct 16, 2008 at 06:59:37AM +0000, Victor Klimov wrote:
>> Hi Leon,
>> Yeah, I know, it should work...
>> But it doesn't:
>> #Rule for alerting common TCP/UDP flood attack:
>> alert ip any any -> any 5060 (msg:"COMMUNITY SIP TCP/IP message
>> flooding directed to SIP proxy"; threshold: type limit, track by_src,
>> count 1, seconds600; classtype:attempted-dos; sid:100000160; rev:2;)
>> This rule above should limit the flooding alert: once in 10 min.
>> However I continue to see a lot of 100000160 alerts, several per minute.
> Do these alerts come from different sources or the same one? As I
> understand thresholds, track by_src means a separate counter for each
More information about the Snort-users