So I found some good firewall rules online that detect port scanners...etc.

The most popular rule seems to be: Can someone please explain to me what these values are:

Weight Threshold
Delay Threshold
Low Port Weight
High Port Weight

Please don't quote the Mikrotik wiki explanation.. doesn't make sense to me :/

I found a host that is port scanning me but is doing it at a very slow rate... roughly one port per 40 seconds. The above rule does not capture this scan and I think it has to do with the slow scanning method is not being detected by this rule.

Weight Threshold = Total score needed to be reached to be thought a port scan attempt
Delay Threshold = Time window for the scores to be calculated
Low Port Weight = Score assigned for a new connection for a port number less than 1024
High Port Weight = Score assigned for a new connection for a port number greater than 1024

So in order for an IP to be detected as a possible port scanner the score reached must be greater than the Weight Threshold. Every connection that comes in from a src IP to the low ports or high ports adds to the score for that IP address. The delay threshold defines how long an IP has reach the threshold given it's current connections. The reason why there is a separate value for low and high ports is because ports 0-1024 are reserved system ports and are more likely to be the target of a port scan, so seeing several connection attempts to those ports means it's more likely to be a port scan.

So yes someone that is scanning one port every 40 seconds, or even every 4 seconds with the settings you have will not reach the score, and the rule will not fire. In fact they would need to attempt to connect to 7 ports numbers 1-1024 within 3 seconds to be considered a port scanner with the rule you have posted. You need to tune the rule to fit your needs, but it's more to catch the low hanging fruit/automated scanners, if someone really wants to scan your IP address they will and they can always set the values in such a way that it will bypass detection like that.

One method that you can use in combination with PSD is to have a set of firewall rules that look for packets to specific port numbers that you know no service is running on, that no one should really be trying to communicate to. For example port 23, if you have Telnet turned off facing the internet (which you should), then someone trying to connect to it over the internet is a give away that they are trying to scan the network. You can then assume that you can block further communicate from them. This method can be abused though, as someone can spoof their source address and cause issues for you as well.

No method of detection is perfect, and they all have their drawbacks and ways around them. You are trying to strike a balance between being secure by mitigating risks and usable. The mikrotik is good for most users since most users will not typically be directly targeted. If you are in an environment where you will be and are directly targeted, you need something more robust to help secure your network, detect when someone is trying to access things they should not, and a way of auditing what is happening so you can tell what happened when.

So I now how a much better understanding.

One remaining part to the puzzle... what is unit of measurement, or what metric is used for 'weight'? Is the packets in bits/bytes? Not sure what this means...

It's just an arbitrary name really, you assign a value you want to the low ports and to the high ports. The router then takes that value when a new connection attempt comes in and adds it to the overall score for that source IP. If the overall score is greater than the defined threshold, the rule fires and does the action.

So I now how a much better understanding.

One remaining part to the puzzle... what is unit of measurement, or what metric is used for 'weight'? Is the packets in bits/bytes? Not sure what this means...

It's a unitless value.

score = N hits * weight.

Hits are counted within the delay-threshold window, so if the window is 10 seconds, for instance - then score = N hits within last 10 seconds * weight.
If score > weight threshold, then src is considered a scanner and the psd criteria returns TRUE.

As mentioned - you can choose some well-known but unused ports and consider that anyone connecting to this port is trying to scan or abuse that port, and I agree with Feklar in saying that you can't just put booby traps on your network without careful consideration, because suppose an attacker decided to "scan" you using spoofed-source IP addresses of 8.8.8.8, 8.8.4.4, 4.2.2.1, 4.2.2.2, (list of well-known DNS resolvers), and all 13 root server IPs? Then your DNS would be blocked by these rules and you'd be effectively dead in the water.... He wouldn't even have to flood your network.

I've considered enabling such measures myself many times, but I just don't trust myself to know more than a hacker who loves what he does, while I just want to be left alone....

Very help advice!

Note however that I am not relying on my systems to auto-ban any suspected malicious host..

What I am doing instead is having addressed added to an address-list, and upon review (most times a query to abuseipdb.com) I then decide where or not to add the host to my ban address list.

Again, very helpful info!

Great article as starting to look at the EXTRA tab.
I think I understand the PSD weight section and it seems to be defaulted to 23, .03, 3 and 1.
Similarly the Limit section is defaulted to 100 connections BUT and here is the point,

The default LIMIT parameter has
the Limit Rate set to ZERO "0" / per second.
With burst set at 5.

Does this mean in effect that the LIMIT parameter is OFF?
In that every connection is considered a HIT and for example all port scans, all IPs should be added to the address list...........

If, then can I assume if the limit rate is set to one "1" per second, then
The router will consider a hit for a source IP (ie capture the IP to the list) when 100 connections occur at or before 100 seconds is up?
In other words putting a number value in the Limit rate, kinda activates the parameter...............

The obvious follow on question is what does this have to do with the PSD settings? Are they related or integrated?
Doe s limit rate set to 0, also mean No weighting is considered???

Or is Weight completely independent?
In other words, as per the default settings for these rules
is 23, .03,3,1 always in effect (if a single IP scans any combination of ports (TCP used as protocol) more than 8 times per .03 seconds (couldnt tell if it was 3 sec or 3/100 of a second) then the IP is capture (sent to address list).

So depending upon the answers above, what seems to be going on is two different rate traps for scanning IPs.......
I would have to say, that both are time decay related in that LIMIT is a long Time Decay affect and WEIGHT is a very short Time Decay effect.
Perhaps they are simply VOLUME detectors with the LIMIT looking at the long term (Dos DDOS appplication) and the Weight is looking at the short term (application scanning)

A. LIMIT (macro)
The LIMIT trap has user entry parameter of the number of connections from a single IP that is of concern (default is 100, typical rules I have seen use anywhere from 20-40) and to bound the time frame for which this is measured, is a user entered connection per second basis.
For example 100 connections at 1/ps means that at or below 100 seconds, if 100 connections are made from that IP, the trap is matched and address sent to address list for example,
The Weight trap seems similar to me and has 3 variables. A total Number
If one selected 2/ps, then at or below 30 seconds, it 100 connections are made the trap is matched.
B.WEIGHT(micro)
The Weight trap seems similar to me and has 3 variables. A total Number of hits is set as a Threshold relative value.
Then a relative value is given to low ports and high ports, and finally a time constraint is added that defines the period of time the relative values are compared (calculated).
In other words (and again this is per single IP), the router is stating if there are a number of points awarded, WITHIN ANY contiguous time period as defined by admin, (relative value given to ports compared to threshold value) The Weight trap is triggered and the IP address is captured to the address list..................
Both rules assume simple setup all ports, TCP

Can somebody explain to me, why my PSD rule is not kicking in with this case?
One single IP is trying to connect on closed port tcp/23, I have full logserver of dropped packets, but this rule is not hitting. One significant thing is, that source port for every connection attempt is the same.
this rule is at bottom, filling my ELK