SSH Brute Force on Network Device Management Port

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects a brute-force attack against an SSH service on a network device management port. It triggers an alert if 15 or more TCP SYN packets are observed from a single source IP address to destination port 22 (SSH) within a 30-second window, indicating an attempt to establish multiple connections, characteristic of a brute-force attempt.