Direct TCP SYN Flood DoS Attack

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.