[Snort-users] Alert on Max connections per IP

wkitty42 at ...14940... wkitty42 at ...14940...
Sun Jun 5 19:41:18 EDT 2016


On 06/05/2016 05:39 PM, Argcyborg wrote:
> Hi, is there a way to alert or drop when receive more than 8 connections per ip
> to an specific port ?

that's called thresholding...

-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.




More information about the Snort-users mailing list