Notes ids.md

1.CUSTOM RULE

alert icmp any any -> any any (msg:"icmp ping Flood Detected";itype:8; sid:1000002; rev:1;)

2. ATTACK COMMAND - sudo hping3 --icmp --flood (ip address)

3.IDS Detection

4.Packet Capture

5. An ICMP flood is a denial-of-service attack where an attacker overwhelms a target server with a massive volume of ICMP echo request (ping) packets. The target system wastes all its computing resources and bandwidth trying to process and respond to every incoming request. This legitimate overload prevents normal users and services from accessing the server.