;COMMENT: Blacklist SYN and ICMP Denial Of Service (DOS) attackers
;DESCRIPTION: Blacklist when receiving more than 300 incoming TCP connections or more than 300 ICMP packets from the same source. The packets must be received within one hour. The remote IP address is blacklisted for 12 hours (per default).


SYN-Flood	
		Comment = "Detect incoming SYN flood",
		Rule-Action = Observe,
		Log-Control = Enabled,
		Log-Message = "Detected TCP SYN flood.",
		Log-Details = "More than 300 incoming TCP connections from the same user was received within one minute. The SYN flood is a possible (D)DOS attack that tries to open a large number of TCP connections on the attacked host. With all the connection slots taken, the victim will generally not be able to serve regular requests. Often modern Operating Systems have additional defensive techniques to overcome this attack. The attack is logged and attacker is blacklisted.",
		Log-Severity = High,
		Observation-Period = "1",
		Observe-Match-Count = 300,
		Direction = Incoming,
		Flags = "SYN -FIN -ACK",

ICMP-Flood	
		Comment = "Detect incoming ICMP flood",
		Rule-Action = Observe,
		Log-Control = Enabled,
		Log-Message = "Detected ICMP flood.",
		Log-Details = "More than 300 incoming ICMP packets from the same remote host was received within one minute. The flood is a possible (D)DOS attack that on high-speed Internet connections can degrade network performance considerably. The attack is logged and attacker is blacklisted.",
		Log-Severity = High,
		Observation-Period = "1",
		Observe-Match-Count = 300,
		Direction = Incoming,
		Protocol = ICMP,

