Port Knocking Sequence Detected on Closed Ports

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects a port knocking sequence on closed ports. It triggers an alert when four TCP SYN packets are observed from the same source IP address within a 5-second window, targeting any port on the home network. This behavior is indicative of an attacker attempting to perform port knocking to open a hidden port or service.