# Looking for a tool detecting abusing IPs **URL:** \ **Category:** Zeek\ **Created:** [September 17, 2011, 8:00pm UTC](https://community.zeek.org/t/looking-for-a-tool-detecting-abusing-ips/2024 "2011-09-17T20:00:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Marc\_Weber](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@Marc\_Weber](https://community.zeek.org/u/Marc_Weber)\ **Post date:** [September 17, 2011, 8:00pm UTC](https://community.zeek.org/t/looking-for-a-tool-detecting-abusing-ips/2024/1 "2011-09-17T20:00:24Z")
Hi mailinglist, The company I'm working for has been attacked by SYN and ddos within the last three weeks. Now we'd like to optimize our setup so that we can cope with most common attacks with minimal resources. To do so we want to block IPs abusing our server eg by requesting too many page views or sending SYN attacks (if the source IP has not been spoofed) etc. Is bro-ids the right tool to do so? If not which alternative would you recommend? Is there someone who would be interested in providing payed support? Which documentation about pro-ids should I read first? I'm little bit lost cause the wiki says most of its information is outdated. We only have to protect the very common services   - HTTP   - POP3   - SMTP Thanks for any guidance. Of course I could use libpcap and code up a tool myself. However I hope that with your knowledge we're up and running much faster. I know about fail2ban - however I'd prefer something not requiring huge logfiles.. Marc Weber ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [September 19, 2011, 3:38pm UTC](https://community.zeek.org/t/looking-for-a-tool-detecting-abusing-ips/2024/2 "2011-09-19T15:38:04Z")
Yes, Bro is an excellent tool for such things. There's the default scan.bro script which reports TCP scans (also UDP if udp.bro is loaded; and icmp.bro can find ICMP scans). Generally, it's pretty straight-forward to add custom logic for fine-tuning reporting or finding other types of scans. We're also in the process of adding a new Metrics framework that generalizes "counting stuff", and it will be able reports scans of all kinds. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/looking-for-a-tool-detecting-abusing-ips/2024/3 "2022-05-06T15:39:50Z")