alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg: "DOS Excessive HTTP Traffic"; flow: to_server, established; threshold: type both, track by_src, count 1000, seconds 10; classtype: denial-of-service; )