# DDoS detection **URL:** \ **Category:** Zeek\ **Created:** [September 4, 2014, 6:37pm UTC](https://community.zeek.org/t/ddos-detection/3254 "2014-09-04T18:37:46Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Tyler\_Schoenke](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tyler\_Schoenke](https://community.zeek.org/u/Tyler_Schoenke)\ **Post date:** [September 4, 2014, 6:37pm UTC](https://community.zeek.org/t/ddos-detection/3254/1 "2014-09-04T18:37:46Z")
Just wondering if anyone has a DDoS detection script for Bro 2.2+. I saw there was an older one for Bro 1.5, but was wondering if someone created an updated one using the new SumStats framework. Please let me know if there is an out-of-the-box way to detect DDoS that I am missing. Thanks, Tyler ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [September 5, 2014, 1:31am UTC](https://community.zeek.org/t/ddos-detection/3254/2 "2014-09-05T01:31:27Z")
Justin, did you ever end up creating one? It should be pretty easy once you define what exactly you want to measure.   .Seth ---
**Author:** ![Tyler\_Schoenke](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@Tyler\_Schoenke](https://community.zeek.org/u/Tyler_Schoenke)\ **Post date:** [September 5, 2014, 9:34pm UTC](https://community.zeek.org/t/ddos-detection/3254/3 "2014-09-05T21:34:28Z")
Thanks guys! Justin, if I’m reading this correctly, the script will only look at ports specified in dos\_ports. Is there a way to match all ports? Are there dangers in doing that? Tyler ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/ddos-detection/3254/4 "2022-05-06T15:42:02Z")