I am trying to implement a simple flooding attack alert by using this rule:

alert tcp any any <> any any (msg:"Flooding attack!";detection_filter:track by_dst, count 4, seconds 1; sid:1000036)

Even if I have traffic 10 Pkts/sec (calculated by Snort) all going to the same destination and it does not alarm.

/var/snort/log/alert is empty.

Packet traces on the snort box shows that all packets are being seen.

Snort version

What am I doing wrong?


In my case, I use this working alert rule for SYN Floods.

alert tcp any any -> any (msg:"TCP SYN Flooding attack detected"; flags:S; threshold: type threshold, track by_dst, count 10 , seconds 30; sid: 5000001; rev:1;)


  • The "threshold" keyword means that this rule logs every event on this SID during a 30 second interval. So, if less than 10 events occur in 30 seconds, nothing gets logged. Once an event is logged, a new time period starts.
  • The "track" by_dst keyword means track by destination IP.
  • The "count" keyword means count number of events.
  • The "seconds" keyword means time period over which count is accrued.
  • The "sid" keyword is used to uniquely identify Snort rules. This information allows output plugins to identify rules easily. This option should be used with the "rev" keyword.
    • sid < 100 Reserved for future use
    • 100 < sid < 999,999 Rules included with the Snort distribution
    • sid > 1,000,000 Used for local rules

There are further information here and here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.