DOS Rapid ICMP Echo Request Flood Detected

Tim Peck@timpeck

•updated Nov 13, 2025•1•3•99

This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.