So I have a snort rule that detects syn flood attacks that looks like this:

alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, count 40, seconds 10;
GID:1; sid:10000002; rev:001; classtype:attempted-dos;)

The problem is, when I trigger it using tcpreplay on vm2 (With a Ddos.pcapng file):

sudo tcpreplay -i interface /home/Practicak/DDoS.pcapng

When listening on my VM1, I get a lot of alerts when listening with the snort rule active. E.G. 100s of Syn Flood Detected alerts.

How can I limit this so that I only get few / 1 alert for each Syn Flood that is initiated? I.E. using the TCPReplay with the pcap file.. & is this good practice to display less alerts?


  • Do you have a siem or a syslog server?
    – DarkMatter
    Mar 7, 2019 at 14:00

1 Answer 1


You can use thresholds (that were replaced with event_filters) to do this:


event_filter gen_id 1, sig_id 10000002, type limit, track by_src, count 1, seconds 3600 

This will generate max. 1 alert per 1 hour for your rule

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.