# Outbound: Port Scanning & Brute Force detection
**URL:** https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162
**Category:** Help
**Created:** [January 27, 2022, 3:42pm UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162 "2022-01-27T15:42:05Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@FlorinMarian](https://forum.suricata.io/u/FlorinMarian)
#### Post date: [January 27, 2022, 3:42pm UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162/1 "2022-01-27T15:42:05Z")
Hello!
I run a small hosting company and I’ve leased a /24 subnet and my IPs provider has very strict rules regarding abuses.
Can anyone help me with some example rules to detect brute force attacks and port scanning going outside of our network to the internet?
We’re running proxmox on Debina 10 with suricata installed.
Thank you!
---
### Author:  [@IDSTower](https://forum.suricata.io/u/IDSTower)
#### Post date: [February 4, 2022, 4:26am UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162/2 "2022-02-04T04:26:25Z")
[Take a look here](https://rules.emergingthreats.net/open/suricata/rules/).
---
### Author:  [@FlorinMarian](https://forum.suricata.io/u/FlorinMarian)
#### Post date: [March 19, 2022, 5:45am UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162/3 "2022-03-19T05:45:44Z")
It works just fine using ET Rules to detect outbound SSH scans but I still have issues blocking port scanning outbound.
Any tip for this achievement?
Thank you!
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [March 21, 2022, 9:34pm UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162/4 "2022-03-21T21:34:48Z")
You could write your own signatures using the threshold feature: [6.31. Thresholding Keywords — Suricata 6.0.4 documentation](https://suricata.readthedocs.io/en/suricata-6.0.4/rules/thresholding.html)
But this might also be easier done within a rate limit in any firewall you have in place as well
---
### Author:  [@FlorinMarian](https://forum.suricata.io/u/FlorinMarian)
#### Post date: [March 22, 2022, 5:09am UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162/5 "2022-03-22T05:09:57Z")
Hi, Andreas!
I cannot figure out how to track number of outbound connections only if they match exactly same port.
What I mean is that I should not provide any port number to destination but suricata itself need to be able to figure out how many outbound connections are made to port 22, 3306 etc.
Thank you!
---
### Author:  [@syoc](https://forum.suricata.io/u/syoc)
#### Post date: [March 22, 2022, 7:57am UTC](https://forum.suricata.io/t/outbound-port-scanning-brute-force-detection/2162/6 "2022-03-22T07:57:12Z")
Alerting/dropping traffic based on number of IPs or ports connected to within a time frame is a heuristics based approach and does not play to the strengths of Suricata IMO. There are some tools at your disposal like thresholding, flowbits, flowint and datasets, though I think that your specific use case is hard to implement.