mirror of
https://github.com/Oxbian/SIDPS.git
synced 2025-05-17 22:18:13 +02:00
9 lines
310 B
Python
9 lines
310 B
Python
# Seuils
|
|
TIME_WINDOW = 180 # 180 secondes pour avoir X paquets
|
|
NB_SEUIL = 5
|
|
|
|
|
|
def rule(packet, tcp_packets):
|
|
if (tcp_packets.count_packet_of_type("A", TIME_WINDOW) + tcp_packets.count_packet_of_type("RA", TIME_WINDOW)) >= NB_SEUIL:
|
|
print(f"Alerte, seuils dépassés, risque de TCPConnectScan")
|