Hi,<br><br>Just out of curiosity - you don't want over N number of simultanious connections from a particular IP ? correct?<br>If that is the case you could "firewall"-it.<br>Or you want just to detect the IP's?<br>
<br>thanks<br><br><div class="gmail_quote">On Thu, Nov 3, 2011 at 10:49 AM, Amrith Z <span dir="ltr"><<a href="mailto:amrith@hotmail.fr">amrith@hotmail.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">




<div><div dir="ltr">
Hi all,<br><br>I'm looking for a way to detect web aspiration. I'm encountering a lot a simultaneous connexions from single IPs, which are scrawling all our web pages.<br><br>Is there a way to detect aspiration, or to configure Suricata to alert when a single IP is having a lot of simultaneous connexions ?<br>
<br>Thx!                                    </div></div>
<br>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Peter Manev<br>
<style>#avg_ls_inline_popup{position:absolute;z-index:9999;padding:0px;margin:0px;overflow:hidden;wordWrap:break-word;color:black;font-size:10px;text-align:left;line-height:130%;}#avg_ls_inline_popup div{border-width:3px;border-style:solid;padding:3px;padding-left:8px;padding-right:8px;-moz-border-radius:5px;-webkit-border-radius:5px;}#avg_ls_inline_popup .red{border-color:#D20003;;background-color:#F5D4C1;;}#avg_ls_inline_popup .orange{border-color:#F57301;;background-color:#FFD3B0;;}#avg_ls_inline_popup .yellow{border-color:#EAA500;;background-color:#FEEFAE;;}#avg_ls_inline_popup .green{border-color:#00A120;;background-color:#C3E5CA;;}</style><div style="visibility: hidden; left: -5000px;" id="avg_ls_inline_popup">
</div>