Add keyword to determine flow based speed/bw
It would be helpful to have a keyword to match a specific bandwith/rate as this could be also used to bypass high traffic flows.
The simple form would be bytes in relation to flow age, pkts and bytes are already tracked as well. It's harder if it needs to be some sliding window with a period of time.
Updated by Andreas Herz over 3 years ago
- Related to Feature #2319: Expose flow lifetime to the rulelanguage added
Updated by Victor Julien 7 months ago
- Related to Task #5645: tracking: elephant flow detection added