Network Host Discovery via UDP Sweep

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.