Count of packets that must be seen during monitoring period to initiate anomaly detection check. Default value varies as below with anomaly: Anomaly Count ARP address scan 50 ARP flood 90 ARP poisoning 6 ARP Failure 6 ICMP address scan 30 ICMP Flood 90 ICMP Unreachable 20 TCP port Scan 20 TCP address scan 30 SYN flood 90 SYN Failure 10 SYN-ACK Scan 2 FIN Scan 6 FIN-ACK Diff 5 RST Count 50