Hi there, yesterday evening a lot of SSL requests from mainly AWS servers flooded my HTTP port 80, nginx logs looked like this:
15.236.39.143 - - [02/Sep/2025:19:46:58 +0200] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xAC\x01#\xEDz6\xCAjW\x08\x8D\x0Ed\xAE\xC9\x0380\x8E\x1F$w\xBAQ\xA0s\xC1\xB3\x07&g\x82 \x9CJI\x97\xB9\xFE\xBD\x9A\xA2\xD9\xDFJ4\xDC\x03\x22ud\x9A\xBB\xF1O\x8C\xB9e\x15\x9C\xBC&\xA7\xC6L\x00&\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x09\xC0\x13\xC0" 400 150 "-" "-" 0.033
For any IP causing this kind of traffic I’ve enabled a fail2ban rule, which blocks these and also sends an e-mail response. However, due to the mass of IPs involved yesterday (over 90 before I closed the ports of the firewall) I wonder if there is a Suricata rule which could cap these kind of requests beforehand?