Hide TCP Probing Attempts and Alerts

ntop / ntopng

Web-based Traffic and Security Network Traffic Monitoring

http://www.ntop.org

GNU General Public License v3.0

6.16k stars 648 forks source link

Hide TCP Probing Attempts and Alerts #8282

Open lucaderi opened 5 months ago

lucaderi commented 5 months ago

Add a preference for disabling the generation of TCP probing attempts (i.e. a TCP connection with unidirectional traffic not yet in connection state). When enabled

probing alerts for such flows should not be generated
score for the server host should not be incremented (or very little)

aseyc commented 5 months ago

This issue is related to another open ticket #8255 both of which are related to having an option to disable alerts for flows which are in a 'connecting' state for more than x seconds. These are normally probing attempts from bots, etc... which some people might not be interested in seeing in NTOPNG due to not being vulnerable to such service requests.