[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] how to detect DDoS attack through HTTP response analysis(throuput)
- To: Full Disclosure <full-disclosure@xxxxxxxxxxxxxxxxx>
- Subject: Re: [Full-disclosure] how to detect DDoS attack through HTTP response analysis(throuput)
- From: "Dobbins, Roland" <rdobbins@xxxxxxxxx>
- Date: Mon, 27 Jun 2011 03:08:19 +0000
On Jun 27, 2011, at 9:30 AM, 김무성 wrote:
> if there are many "408 request timeout" responses, we can think this is
> slowloris or RUDY DDoS attack.
Many things can cause this - not just DDoS. In fact, I've rarely seen a DDoS
resulting in these responses, because in an effective DDoS, one often doesn't
get any response at all.
;>
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@xxxxxxxxx> // <http://www.arbornetworks.com>
The basis of optimism is sheer terror.
-- Oscar Wilde
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/