Syn Flood announcer

RouterOS Scripting
1

Hy, i’m wondering if someone can help me with a script that will do the following things:

Every time is SYN flood on one of my ip’s (i have a /24 class)… the script’s job is to send me mail with attacked IP.
I have a rule in firewall that drop packets when someone is SYN flooding one of my ip’s. If it is possible the script will monitor that rule and when the traffic is more than 1 MB /s to send mail.

2

You can read matched packets, if matched packets in timeframe exceed certain value, then send an email.

:glboal lastPackets;
:local currentPackets [/ip firewall filter get <id> packets];
:if ( (currentPackets - lastPackets) > 100) do={
    # send an email
}
:set lastPackets $currentPackets;
3

K thank’s i made some changes to script

:global lastPackets;
:local currentPackets [/ip firewall filter get 8 packets];
:if ( ($currentPackets - $lastPackets) > 100) do={
   /tool e-mail send to="recipient" subject="Syn flood detected" from=routermail server=ip
}
:set lastPackets $currentPackets;

Now how do i retreive the atacked ip to include it in mail subject?