I am trying to implement a simple flooding attack alert by using this rule:
alert tcp any any <> any any (msg:"Flooding attack!";detection_filter:track by_dst, count 4, seconds 1; sid:1000036)
Even if I have traffic 10 Pkts/sec (calculated by Snort) all going to the same destination and it does not alarm.
/var/snort/log/alert is empty.
Packet traces on the snort box shows that all packets are being seen.
Snort version 220.127.116.11
What am I doing wrong?