VXLAN Traffic Duplication for Exfiltration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential VXLAN traffic duplication for exfiltration purposes. It specifically looks for TCP traffic on port 4789 (the default VXLAN port) directed towards the home network. A threshold of 10 connections from the same source within 30 seconds triggers the alert, indicating a high volume of VXLAN traffic that could be indicative of data exfiltration.