VMware ESXi Management Port Access

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.