# How to reduce same events using trac by\_both?

**URL:** <https://forum.suricata.io/t/how-to-reduce-same-events-using-trac-by-both/358>\
**Category:** Developers\
**Created:** [June 23, 2020, 2:37am UTC](https://forum.suricata.io/t/how-to-reduce-same-events-using-trac-by-both/358 "2020-06-23T02:37:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shyang](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@shyang](https://forum.suricata.io/u/shyang)\
**Post date:** [June 23, 2020, 2:37am UTC](https://forum.suricata.io/t/how-to-reduce-same-events-using-trac-by-both/358/1 "2020-06-23T02:37:30Z")

</div>

Is there a way to use thresholds when events occur on the same source ip and destination ip?  
trac by\_src and by\_dst cannot be used because source IP and destination IP are required for response.  
Do you hear about the roadmap to add by\_both?

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [June 29, 2020, 1:06pm UTC](https://forum.suricata.io/t/how-to-reduce-same-events-using-trac-by-both/358/2 "2020-06-29T13:06:50Z")

</div>

There is some `by_both` support in 5.0. It’s been extended for the upcoming 6.0:  
[https://suricata.readthedocs.io/en/latest/search.html?q=by\_both&check\_keywords=yes&area=default#](https://suricata.readthedocs.io/en/latest/search.html?q=by_both&check_keywords=yes&area=default#)

---

<div class="post-metadata">

**Author:** ![shell\_xu](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/shell_xu/32/63_2.png) [@shell\_xu](https://forum.suricata.io/u/shell_xu)\
**Post date:** [July 20, 2020, 2:13pm UTC](https://forum.suricata.io/t/how-to-reduce-same-events-using-trac-by-both/358/3 "2020-07-20T14:13:38Z")

</div>

Hi.  
Will you consider adding the by\_src\_port or by\_dst\_port feature?  
It’ll be easy to detect port scans.