High Port Range Scan Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.