NAT Traversal via GRE Encapsulation Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects NAT traversal attempts using GRE (Generic Routing Encapsulation) protocol. It specifically looks for IP packets with protocol number 47 (GRE) and triggers an alert if 5 such packets are observed from the same source IP within a 30-second window. This could indicate an attempt to bypass network address translation or firewalls.