I am trying to implement a simple flooding attack alert by using this rule:

alert tcp any any <> any any (msg:"Flooding attack!";detection_filter:track by_dst, count 4, seconds 1; sid:1000036)

Even if I have traffic 10 Pkts/sec (calculated by Snort) all going to the same destination and it does not alarm.

/var/snort/log/alert is empty.

Packet traces on the snort box shows that all packets are being seen.

Snort version

What am I doing wrong?


1 Answer 1


In my case, I use this working alert rule for SYN Floods.

alert tcp any any -> any (msg:"TCP SYN Flooding attack detected"; flags:S; threshold: type threshold, track by_dst, count 10 , seconds 30; sid: 5000001; rev:1;)


  • The "threshold" keyword means that this rule logs every event on this SID during a 30 second interval. So, if less than 10 events occur in 30 seconds, nothing gets logged. Once an event is logged, a new time period starts.
  • The "track" by_dst keyword means track by destination IP.
  • The "count" keyword means count number of events.
  • The "seconds" keyword means time period over which count is accrued.
  • The "sid" keyword is used to uniquely identify Snort rules. This information allows output plugins to identify rules easily. This option should be used with the "rev" keyword.
    • sid < 100 Reserved for future use
    • 100 < sid < 999,999 Rules included with the Snort distribution
    • sid > 1,000,000 Used for local rules

There are further information here and here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .