I get a lot of 'TCP SYN Host Sweep On Same Dest Port' events on my network that I want to filter out. All the events with destination port 0 are false positives since this is normal behaviour for many operating systems when starting a connection.
Unfortunately MARS does not allow me to filter these events since in the 'Tune' section a match destination port '0' is interpreted as match 'any'.
Has anyone else had this problem or is there a workaround?
I get literally thousands of these a day on a moderate sized network (2 class Bs)