[Snort-inline-users] Rules to findout DDOS SYN attack

[bharathi <bha...@au...>]

Hi all,
             We have implemented the snort-inline service in our huge 
network. In that we are frequently getting unwanted DOS/DDOS syn 
traffic.Hence
we need to drop all those DOS SYN packets without any disturbtion on the 
normal SYN traffic ( Ex: to port 80,22,25,3306 ..). How to do it?

Plz give me any suggestions.

Thanks and Regards,
Bharathi Raja.