[Snort-users] Alert on Max connections per IP

Argcyborg argcyborg at ...11827...
Mon Jun 6 18:40:13 EDT 2016

Hi, if I use this rule, what be the threshold two config?
alert tcp $EXTERNAL_NET any -> 4000 ( msg:"Deteccion de
conexiones"; flow:established,to_server; content:"|0d 00 00 00 50 cc 5d ed
b6 19 a5 91 00|"; nocase; rawbytes; detection_filter: track by_src, count 2,
seconds 60; sid:1000050; rev:1;)

Thanks again!

-----Mensaje original-----
De: wkitty42 at ...14940... [mailto:wkitty42 at ...14940...] 
Enviado el: domingo, 5 de junio de 2016 20:41
Para: snort-users at lists.sourceforge.net
Asunto: Re: [Snort-users] Alert on Max connections per IP

On 06/05/2016 05:39 PM, Argcyborg wrote:
> Hi, is there a way to alert or drop when receive more than 8 connections
per ip
> to an specific port ?

that's called thresholding...

  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are

consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort

More information about the Snort-users mailing list