Re: how to detect DDoS attack through HTTP response analysis(throuput)

[Kai <kai () rhynn net>]

 Hi,

 its kinda <s>stupid</s> incorrect way of detecting ddos by reading http 
 responce.
 if server says error 408, it could be just a script which takes long to 
 complete. if there is some caching server, e.g. nginx, before actual web 
 server, e.g. apache httpd, then error 502 could be a result of any 
 apache death, not a ddos attack.
 but if you still want to monitor sites in such "unusual" way, and if 
 you have access to web-servers' serverstatus, you'd could parse them to 
 find out: amount of simultaneous requests; similar requests by IP; 
 similar requests by Requested Page; etc.



-- 
 Cheers,

 Kai

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/