Network Host Discovery via TCP SYN Sweep

Darshan Thummar@Mighty

•updated Jun 10, 2026•2•0•6

This rule detects network host discovery attempts using a TCP SYN sweep. It triggers when a source IP sends 30 or more TCP SYN packets (indicated by the 'flags:S' option) to any destination on the HOME_NET within a 10-second window. This behavior is characteristic of an attacker attempting to identify active hosts on a network by sending SYN packets and observing which hosts respond with a SYN-ACK.