UDP Traceroute Network Discovery

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.