script alert mikrotik found flooding attack outside/inside

RouterOS Scripting
1

Hello all,

someone can help me?i have mikrotik hubolt i use for router, now i have a problem when some IP do flooding to some host behind my router mikrotik. this host rekuest port http (dport 80) is a big more 5 Mbps/second

i difficulty to create script, when mikrotik detect flooding attack, the script can e-mail the administrator with this criteria

  • source ip detect
  • source port detect
  • how much bandwidth ip flooding attack


    thank you very much
    i need this script
    Cyd
2

Under the extra tab of the firewall rules you can match the rate or something. I am not sure what the flooding traffic looks like but once you match it you can do something with the traffic like add a mark then queue it to slow it or add it to a list or both. You could write a script to act upon the list if you go that route.