Re: SYN flood detection

[Erek Adams <erek () theadamsfamily net>]

On Fri, 10 May 2002, Matt Kettler wrote:

> spp_portscan is intended to detect portscans, not syn floods. It's designed
> to detect numerous connections to *different* ports. A syn-flood detector
> is pretty similar in code design to spp_portscan, but detects something
> very different.

And to detect scans to the _same_ port on _different_ machines.

> perhaps a spp_synflood should be created to detect numerous connections
> period? I'd suspect you'd want different settings for the portscan and
> synflood versions anyway. (ie: 4 different ports in 3 seconds is sufficient
> to call it a portscan, but more like 400 connections to call it a synflood.)

This would really be a value that would have to be played with...  But, yes--I
think it would be nice to have as a plugin.  Any coder voulnteers?  ;-)

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users