# detect Ack flooding attack

**URL:** <https://community.zeek.org/t/detect-ack-flooding-attack/749>\
**Category:** Zeek\
**Created:** [May 12, 2005, 10:59pm UTC](https://community.zeek.org/t/detect-ack-flooding-attack/749 "2005-05-12T22:59:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\
**Post date:** [May 12, 2005, 10:59pm UTC](https://community.zeek.org/t/detect-ack-flooding-attack/749/1 "2005-05-12T22:59:23Z")

</div>

Hi Scott,  
&nbsp;&nbsp;&nbsp;Thank you for your reply. Bro didn't work without filter expression. this is  
why I tried to use this filter expression. conn and weird analyzers did  
generated some log records, but none of them captured the packets  
having random source IP addresses. Weird analyzer recorded some "weird"  
connections having good syn, ack and fin flags.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This traffic data is actually the DAPAR 2000 data set of MIT LL. I believe  
it was captured from a real Lan. I doubt that Bro, in default setting, doesn't  
record connection information if it did see SYN packets. The problem is how to  
change this default setting.

thanks again

Bing

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/detect-ack-flooding-attack/749/2 "2022-05-06T15:37:28Z")

</div>