ü Syn packets in all tcp packets generally should not exceed 1/7 --- Otherwise Syn Flood attack
ü HTTP request (e.g., 128) in response to the ratio of 200 for Web Server code should not be too low (+ 60%)
ü connections never break a certain value (such as 1000)
ICMP port / protocol ü host unreachable amount received will not be more than 2000
u (transverse) is the number of active certain protocols, such as SSDP protocol