Paul Moore wrote:
Is there a way to setup hobbit's port monitoring to alert when a specific
device has X number of established connections on particular port? IE
alerting when one client has 20 sessions connected to port 80 signifying a
DOS attack?
hobbit-clients.cfg:
HOST=myDOSTarget
PORT REMOTE=%x.x.x.X.nnn STATE=ESTABLISHED MIN=1 MAX=20
Paul Moore V966-5159
MSO OSS Support
-=-=-=-=-=
Pinky, Are You Pondering What I'm Pondering?
Well, I think so Brain but if Jimmy cracks corn and no one cares, why does
he keep doing it?