Home intrusion detector's syn_scan rule could never fire, author reports

A developer building CNDS, a home-network intrusion detector that uses Scapy and five detection engines, ran it on a Raspberry Pi 5 and saw alert volumes of around 45 per hour on day one, with roughly 178 and 336 false positives on two October days. Causes included untrained demo models saturating their scores, critical payload regex rules firing on encrypted traffic, and a monitoring probe generating most remaining alerts. After fixing these, daily alerts dropped to 37 to 63 with none rated high or critical. A red-team test then revealed that the syn_scan rule had a contradictory condition that made it impossible to trigger, since every SYN packet also counts as a forward packet. The author fixed the rule and made it critical, though a SYN flood test still produced no alert, prompting further investigation.