Full Disclosure mailing list archives
Re: how to detect DDoS attack through HTTP response analysis(throuput)
From: Kai <kai () rhynn net>
Date: Mon, 27 Jun 2011 07:01:06 +0400
Hi, its kinda <s>stupid</s> incorrect way of detecting ddos by reading http responce. if server says error 408, it could be just a script which takes long to complete. if there is some caching server, e.g. nginx, before actual web server, e.g. apache httpd, then error 502 could be a result of any apache death, not a ddos attack. but if you still want to monitor sites in such "unusual" way, and if you have access to web-servers' serverstatus, you'd could parse them to find out: amount of simultaneous requests; similar requests by IP; similar requests by Requested Page; etc. -- Cheers, Kai _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- how to detect DDoS attack through HTTP response analysis(throuput) 김무성 (Jun 26)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) Dobbins, Roland (Jun 26)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) Kai (Jun 26)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) nix (Jun 28)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) Emanuel dos Reis Rodrigues (Jun 28)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) nix (Jun 28)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) coderman (Jun 28)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) Ferenc Kovacs (Jun 29)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) 김무성 (Jun 29)
- Re: how to detect DDoS attack through HTTP response analysis(throuput) coderman (Jun 29)