How to Detect DDoS Attack: Warning Signs & Defense Playbook

Detecting a distributed denial-of-service (DDoS) attack early often hinges on establishing comprehensive traffic baselines and configuring threshold-based SIEM alerts for packet rates, connection rates, and resource utilization. In February 2024, Cloudflare mitigated a record 201 million requests per second (RPS) DDoS attack, demonstrating that waiting for service degradation signals an incident is too late. This guide provides security engineers with specific actions and signals for early DDoS detection, actionable response steps, and controls to protect critical infrastructure.

How DDoS attack Works: The Attack Chain

DDoS attacks aim to make an online service unavailable by overwhelming it with traffic from multiple compromised systems. Think of a DDoS attack like a flash mob trying to get into a popular concert venue. Instead of a few legitimate ticket holders, hundreds of thousands of people, most without tickets, suddenly surge the gates, overwhelming the security, ticket scanners, and entryways. Legitimate attendees can't get in, and the show can't start.

Here's how the chain typically unfolds:

1. Preparation and Recruitment

Attackers first compromise a large number of devices, often through malware campaigns, phishing, or exploiting vulnerabilities like those found in old IoT devices. They'll typically use remote access Trojans (RATs) or custom botnet malware to gain control, effectively recruiting these devices into a botnet. These devices might be running outdated firmware, making them easy targets.

2. Command and Control (C2)

Once compromised, botnet agents establish communication with a C2 server, forming a hierarchical or decentralized network. The C2 infrastructure allows the attacker to issue commands to the entire botnet or specific clusters. Attackers might use encrypted channels or common protocols like IRC or HTTP to disguise their C2 traffic.

3. Target Selection

The attacker identifies a specific target, often a website, application server, or network infrastructure, that they want to disrupt. This selection might be driven by financial gain, political motives, or competitive advantage. Attacks can be precisely timed, like the large-scale volumetric attacks seen against Ukrainian government sites in 2022 by groups like Killnet.

4. Attack Launch (T1499)

Upon command from the C2, the botnet unleashes a coordinated flood of traffic toward the target. This traffic overwhelms network bandwidth, server resources, or application capabilities. The technique T1499 encompasses this act of "Denial of Service" via "Network Flood" or "Application-Layer Flood." Different attack types, such as a SYN Flood (T1499.001) or DNS Amplification (T1499.002), might be employed, sometimes in combination, to achieve maximum impact.

DDoS attack Variants and Types

DDoS attacks aren't a single phenomenon; they come in several forms, each exploiting different layers of the network stack. Understanding the distinctions helps us tailor our defenses.

Volume-based Attacks (Layer 3/4)

These attacks aim to saturate the target's bandwidth or network capacity, often measured in bits per second (bps). They simply send massive amounts of traffic. Examples include UDP Flood, ICMP Flood, and SYN Flood (MITRE ATT&CK Technique ID: T1499.001), which overwhelms a server's ability to complete TCP handshakes by exhausting its half-open connection table. Microsoft Azure mitigated a volumetric DDoS attack peaking at 3.47 Tbps in late 2023.

Protocol Attacks (Layer 3/4)

Exploiting vulnerabilities in the network protocol stack, these attacks consume server resources like connection tables or firewalls, measured in packets per second (pps). DNS Amplification (MITRE ATT&CK Technique ID: T1499.002) is a common example, where attackers send small queries to open DNS resolvers with a spoofed target IP, causing large responses to be sent to the victim. NTP Amplification and Memcached Amplification work similarly, reflecting and amplifying traffic using open, misconfigured services.

Application-Layer Attacks (Layer 7)

Targeting specific applications and web servers, these attacks mimic legitimate user behavior to consume application resources, measured in requests per second (RPS). An HTTP Flood (MITRE ATT&CK Technique ID: T1499.001) overwhelms servers with numerous HTTP GET/POST requests. Slowloris is another variant that holds open numerous HTTP connections by sending partial requests, tying up server processes and preventing legitimate connections. The Mantis botnet, which Cloudflare attributed to the 2024 Cloudflare attack, often employs sophisticated application-layer vectors.

How to Detect DDoS attack: Warning Signs and IOCs

Early detection is paramount. Waiting for service degradation means you're already losing. Focus on threshold-based monitoring and behavioral anomalies.

Target Server/Application Indicators

On target servers, you'll see a surge in resource utilization. Look for sustained high CPU usage (e.g., above 90% for several minutes) and memory exhaustion from web server processes or database queries. Check your web server logs (Apache, Nginx, IIS) for an abnormal increase in 5xx errors (e.g., 503 Service Unavailable) and connection timeouts. While not directly a DDoS trigger, a sudden spike in failed login attempts, potentially logged as Windows Event ID 4625 on Active Directory servers, can indicate a precursor brute-force or a credential stuffing attack accompanying the DDoS.

Network Indicators

Network traffic monitoring tools like NetFlow or sFlow are your first line of defense. Look for:

• Unusual traffic spikes: An immediate, massive increase in bandwidth consumption (e.g., 500% above baseline).
• High packet/connection rates: An unprecedented volume of packets per second (pps) or new connections per second (cps) to target IPs and ports.
• Specific port/protocol abuse: A sudden surge in UDP traffic directed at web servers (ports 80, 443) or DNS servers (port 53).
• Geographic anomalies: Traffic originating from unusual or historically inactive geographic regions, especially for application-layer attacks.
• Abnormal TCP patterns: For SYN floods, you'll see a high rate of incoming SYN packets with very few corresponding SYN-ACK or ACK packets. Tools like Wireshark can help visualize this during an incident.

SIEM Detection

Configure your SIEM (e.g., Splunk, QRadar, Elastic Security) with threshold-based alerts to catch anomalies before they cripple your services.

• Volumetric Traffic Alert: Trigger when incoming bandwidth to critical services exceeds a predefined threshold (e.g., 1 GB/s or 100,000 pps) for a 60-second window.
  • Splunk example: index=network_traffic (dest_ip=[your_critical_ip]) | timechart span=1m sum(bytes) as traffic_bytes, count as total_packets | where traffic_bytes > 1GB OR total_packets > 100000
• Connection Rate Alert: Trigger when new connections per second to a web server port (80, 443) exceed a baseline by 300%.
• Error Rate Alert: Alert when HTTP 5xx errors from web servers jump by 500% above the hourly average.
• IDPS/IPS integration: Ensure your Intrusion Detection/Prevention System (IDPS/IPS) is feeding logs to your SIEM. It can flag known DDoS signatures or suspicious traffic patterns, such as fragmented packets or malformed headers, though sophisticated attacks often bypass these.

Response Playbook: What to Do When DDoS attack Hits

When a DDoS attack hits, every second counts. Execute a predefined playbook to contain, preserve, and recover.

Phase 1: Immediate Containment (first 15 minutes)

This phase is about minimizing impact.

1. Activate cloud-based DDoS mitigation: If you subscribe to services like Cloudflare, Akamai, or Imperva, activate their always-on or on-demand protection profiles immediately. This is often the fastest and most effective first step.
2. Contact your ISP: Inform your Internet Service Provider (ISP) and request BGP Flowspec or blackhole routing for the affected IP address. This can divert malicious traffic upstream before it reaches your network.
3. Implement temporary firewall rules: If cloud mitigation isn't an option or is insufficient, block egregious source IPs with firewall rules. For Linux systems, use iptables -A INPUT -s [malicious_IP] -j DROP. Implement rate limiting at your perimeter firewall for target ports and protocols (e.g., limit new TCP connections to port 443 from a single source to 10 per second).
4. Enable CAPTCHA/WAF rules: For application-layer attacks, deploy or strengthen Web Application Firewall (WAF) rules to challenge suspicious requests or block traffic from known malicious user agents.

Phase 2: Forensic Preservation

Before you clean up, preserve evidence for post-incident analysis.

1. Collect and secure logs: Gather logs from all affected systems, network devices, CDN, and DDoS mitigation services. This includes firewall, server (web, application, OS), load balancer logs, and SIEM alerts.
2. Capture network packets: If possible and safe, capture network traffic on the affected interface using tools like tcpdump or Wireshark. Use tcpdump -i [interface] -w ddos_capture.pcap -s 0 -c 100000 to capture a sample of packets without truncation.
3. Take system snapshots: If the attack involved compromise (uncommon for pure DDoS but possible for precursor activity), take forensic images or snapshots of compromised systems.

Phase 3: Recovery and Hardening

Once the attack subsides, focus on safe restoration and preventing recurrence.

1. Verify attack cessation: Monitor traffic and system metrics closely to confirm the attack has genuinely stopped. Don't rush to restore.
2. Gradually restore services: Bring services back online incrementally, monitoring resource utilization and traffic patterns at each step.
3. Conduct post-incident analysis: Review all collected logs and network captures. Identify the attack vectors, source IPs, botnet characteristics, and vulnerabilities exploited. Use this to refine your detection and response plans.
4. Patch identified vulnerabilities: Ensure all systems, especially those that were part of the botnet (if you were a C2 target) or misconfigured services, are fully patched and secured. The CISA advisory AA22-110A on DDoS mitigation strategies recommends this.
5. Improve defenses: Update your DDoS mitigation strategies, refine SIEM alerts, enhance rate limiting, and review your network architecture for weaknesses.

How to Prevent DDoS attack: Controls That Work

Effective prevention requires a layered approach, integrating architectural resilience with active monitoring.

Network Architecture & Boundary Protection

Implementing network redundancy, load balancing, and strong ingress/egress filtering on border routers/firewalls is critical (NIST SP 800-53 SC-7 Boundary Protection). Utilize cloud-based DDoS protection services that leverage Anycast networks, distributing traffic across many global points of presence. For organizations seeking to bolster their perimeter, deploying solutions like Cloudflare Zero Trust can provide essential SC-7 Boundary Protection by securing network access and filtering malicious traffic before it impacts your infrastructure.

Network Segmentation & Traffic Control

Isolate critical services through network segmentation to limit the blast radius of any attack (NIST SP 800-53 SC-7 Boundary Protection). Configure rate limiting on network devices and gateways (e.g., at load balancers, WAFs) to throttle requests per second from suspicious sources (NIST SP 800-53 SC-7 Boundary Protection). This helps prevent resource exhaustion from application-layer floods.

Application Security & Updates

Deploy Web Application Firewalls (WAFs) to filter malicious HTTP requests and protect against Layer 7 attacks (NIST SP 800-53 SC-7 Boundary Protection, SI-10 Information Input Validation). Ensure your WAF rules are regularly updated. Regularly patch all devices and applications to prevent them from being compromised and recruited into botnets (NIST SP 800-53 SI-2 Flaw Remediation). This includes server OS, web server software, and IoT devices.

Monitoring, Logging & DNS Hardening

Establish comprehensive traffic monitoring and baselines to detect anomalies quickly (NIST SP 800-53 AU-6 Audit Record Review Analysis and Reporting, CA-7 Continuous Monitoring, SI-4 System Monitoring). Ensure your authoritative DNS servers are resilient, implementing DNSSEC and distributing them across multiple providers or geographic locations (NIST SP 800-53 SC-7 Boundary Protection, SC-8 Transmission Confidentiality and Integrity).

Real-World Incidents

Studying past incidents offers critical insights into detection and mitigation failures. These events underscore the evolving nature and impact of DDoS attacks.

Cloudflare (2024)

In February 2024, Cloudflare successfully mitigated a record-breaking DDoS attack that peaked at 201 million requests per second (RPS). This volumetric attack, primarily targeting crypto and gaming companies, was attributed to the 'Mantis' botnet. It leveraged a new HTTP/2-based "Rapid Reset" technique that allowed a single connection to generate thousands of requests. Cloudflare reported the attack was 7.5 times larger than any previous HTTP DDoS attack it had reported. Without cloud-based mitigation and proactive protocol-level defenses, the targeted services would've faced severe, prolonged outages. Relying solely on traditional on-premise solutions is insufficient against modern, hyper-volumetric attacks; specialized T1499.001 (HTTP Flood) mitigation is paramount.

Microsoft Azure (2023)

In late 2023, Microsoft Azure's DDoS Protection services mitigated a massive volumetric DDoS attack against one of their customers, peaking at an astounding 3.47 Tbps. This multi-vector attack, lasting over 15 minutes, involved various techniques designed to overwhelm network bandwidth. The attackers specifically targeted UDP and SYN flood vectors, demonstrating sophisticated coordination. Despite the immense scale, Azure's automated detection and mitigation capabilities kicked in immediately, absorbing the traffic without service impact for the targeted customer. The key takeaway from this incident is the necessity of "always-on", hyper-scale DDoS protection that can automatically detect and respond to multi-terabit attacks leveraging T1499.001 (SYN Flood) and T1499.002 (UDP Flood) techniques, minimizing human intervention delays.

Russian State-Sponsored Attacks (2022-2023)

Following the invasion of Ukraine, Ukrainian government and critical infrastructure websites faced persistent and coordinated DDoS attacks throughout 2022 and 2023. Groups like Killnet, often linked to Russian state-sponsorship, repeatedly targeted financial institutions, energy providers, and government portals, causing significant downtime and operational disruption. These attacks frequently employed both volumetric and application-layer methods (T1499.001 and T1499.002), aiming to sow chaos and hinder communication. For instance, several Ukrainian banking websites were rendered inaccessible for hours during peak attack periods. The lesson learned is that politically motivated DDoS attacks are often persistent and multi-vector; critical infrastructure requires continuous monitoring, a strong incident response plan, and international collaboration to withstand such sustained campaigns, as highlighted by CISA's advisories.

Data at a Glance

The CVEDaily Take

Standard DDoS detection often focuses too late on bandwidth saturation. We believe the overlooked early warning signal is an abnormal rise in connection state table usage on firewalls or load balancers, even with modest traffic volume. This indicates a protocol or application-layer attack stressing resources, not just pipes. What's your SIEM alert threshold for connection count per minute on your main ingress firewall, and how have you tuned it to differentiate legitimate spikes from slow-drip DDoS?

Tools & Resources

Equipping your team with the right tools is critical for effective DDoS detection and response.

Detection (SIEM)

• Splunk Enterprise Security: A comprehensive SIEM that aggregates logs from all network devices, servers, and applications. It provides real-time alerting based on customizable thresholds for packet rates, connection rates, and error codes, essential for detecting volumetric and application-layer DDoS.
  • Official Splunk Documentation
• Elastic Security (formerly Elastic SIEM): Offers powerful log aggregation, threat hunting, and anomaly detection capabilities, leveraging the Elastic Stack (Elasticsearch, Kibana, Beats, Logstash). It's great for visualizing traffic patterns and setting up alerts for unusual activity.
  • Official Elastic Security Documentation

Prevention (Cloud-based Mitigation)

• Cloudflare DDoS Protection: Leverages a global Anycast network to absorb and filter DDoS traffic close to the source, offering always-on protection for network and application layers, including HTTP/2-based attacks.
  • Cloudflare DDoS Protection
• Azure DDoS Protection: Provides enterprise-grade protection for Azure resources, automatically scaling to mitigate multi-terabit attacks without impacting service availability for customers.
  • Azure DDoS Protection Documentation

Incident Response (Network Analysis)

• Wireshark: An essential network protocol analyzer for deep packet inspection. Use it during an active attack to capture and analyze traffic, identifying specific attack vectors like high SYN-to-ACK ratios in SYN floods.
  • Official Wireshark Download
• tcpdump: A command-line packet analyzer for Unix-like operating systems. It's invaluable for capturing network traffic samples on remote servers or network appliances during an incident without a full GUI.
  • tcpdump Man Page (Linux)

FAQ

Q: How to detect DDoS attack?
A: Detect DDoS attacks by monitoring for unusual traffic spikes (e.g., 500% above baseline), high packet/connection rates to critical services, and increased server resource utilization (e.g., CPU above 90%). Configure SIEM alerts for these thresholds.

Q: How to respond to a DDoS attack attack?
A: When a DDoS attack hits, immediately activate cloud-based DDoS mitigation services, contact your ISP to implement BGP Flowspec or blackhole routing, and configure temporary firewall rules to block egregious source IPs or rate limit traffic.

Q: How to prevent DDoS attack?
A: Prevent DDoS attacks by implementing NIST SP 800-53 SC-7 Boundary Protection controls, such as deploying cloud-based DDoS protection services and Web Application Firewalls (WAFs). Also, maintain strong ingress/egress filtering and network segmentation for critical services.