#!/bin/sh
#
# Alert on high TCP SYN-RECV count.
#

SYN_COUNT=$(ss -tan state syn-recv | grep -c syn-recv)

THRESHOLD=10

if [ "$SYN_COUNT" -gt "$THRESHOLD" ]; then
    echo "High SYN-RECV count detected: $SYN_COUNT at $(date)" \
        | s-nail -s "Suspicious SYN threshold on $(hostname)" root
fi