Detecting SYN Floods

["Sheahan, Paul" <Paul.Sheahan () priceline com>]

I would like to do both of the following with Snort:

 

*       Detect a high number of SYNs from one source over a short period
of time
*       Detect a high number of requests for a web page over a short
period of time

 

Just curious if anyone has found a good way to do this with Snort.

 

Thanks