How to detect a DDoS attack?

geodirk

I've gotten a few notices over the last few months from a LEB provider that there was a DDoS attack on my server. Just for my education, how does one detect an attack? I realize that connection to my server might be sluggish under a DDoS. But how do I tell the difference between an attack and just a crappy provider's network?

Thanks

Ishaq

If it's a real DDoS your connection won't be sluggish, it will be completely down.

You don't usually have the access to detect a real attack, as it's usually noticed (and action is taken) by the bandwidth providers or your service provider.

If the network is bad most of the time then it's unlikely to be a DDoS attack and instead just a crappy network.

geodirk

@Ishaq said:
If it's a real DDoS your connection won't be sluggish, it will be completely down.

You don't usually have the access to detect a real attack, as it's usually noticed (and action is taken) by the bandwidth providers or your service provider.

If the network is bad most of the time then it's unlikely to be a DDoS attack and instead just a crappy network.

Makes sense...thanks!

Francisco

Ishaq said: If it's a real DDoS your connection won't be sluggish, it will be completely down.

It could be a compromised VPS sending an outbound DOS attack which likely wouldn't max the line so hard to drop the box but it would lag things pretty good

XORDOS is still very much a thing.

Francisco