Hunting

Statistics → Endpoints → IPv4 Statistics → Conversations → TCP Statistics → Protocol Hierarchy

Goal

Many random spoofed IPs flood single target. No handshake completion.
Pure volume exhaustion.

Red flags

• Many SYN packets from many unique IPs
• Very low packet count per source IP
• No completed TCP handshakes
• Large number of half-open connections

Filters

# Many SYNs to same host
tcp.flags.syn == 1 && tcp.flags.ack == 0

# No handshake completion
tcp.flags.syn == 1 && tcp.flags.ack == 1

# High packet rate to single port
tcp.dstport == 80