Suricata

It would be helpful to have a keyword to match a specific bandwith/rate as this could be also used to bypass high traffic flows.

The simple form would be bytes in relation to flow age, pkts and bytes are already tracked as well. It's harder if it needs to be some sliding window with a period of time.