DOS Sustained ICMP Flood Attempt
This rule detects a sustained ICMP flood attempt, which is a type of Denial of Service (DoS) attack. It triggers an alert if more than 100 ICMP packets (type 8, echo request) are observed from an external network to the home network within a 10-second window, tracked per source IP. This indicates an adversary is attempting to overwhelm the target system or network with ICMP traffic.
Suricata
