Bridge WAF
Am I being DDoSed? Signs of a DDoS attack, and what to check
DDoS detection is telling, quickly and correctly, that a slowdown or outage is caused by an attack rather than by a release, a campaign, a broken dependency or a provider's incident. The signs differ by layer: a full network link looks different from exhausted connection tables, and both look different from a site drowning in valid requests. Getting the cause right decides who can fix it.
Quick facts
- Getting DDoSed means
- Your service is being made unavailable by traffic or work from many sources at once
- First question
- Is it an attack, or something you or a provider changed?
- Second question
- Which resource is exhausted: link, connection state or the application?
- Look at
- Traffic volume, connection counts, error rates, request patterns, provider status
- Common false alarm
- A release, a marketing campaign, a crawler or a failed dependency
What a DDoS attack is, in full, is on what is a DDoS attack.
Signs of a DDoS attack at each layer
| Layer | What you see | Where you see it |
|---|---|---|
| Volumetric | Inbound traffic at the link's capacity; everything on the link slows, not only the site | Provider graphs, interface counters |
| Protocol | Many half-open or idle connections; new connections time out while bandwidth looks normal | Connection tables, load balancer metrics |
| Application | Request rate up on a few paths, servers busy, errors rising, bandwidth only moderate | Access logs, application metrics |
The layer tells you who can help. A full link needs the provider; connection exhaustion needs network devices or the edge; an application flood needs rate limits and filtering. The three families in detail: volumetric, protocol and application attacks.
Attack, traffic spike or outage?
- A release or configuration change. Check deploy times; a slow new query looks like an attack from outside.
- A campaign or mention. Real visitors arrive through normal pages, from referrers, with varied behaviour.
- A crawler or integration. One user agent or key, steady rate, often identifiable and contactable.
- A provider incident. Check the status pages of hosting, DNS and payment providers.
- An attack. Many sources, uniform behaviour, traffic to paths or ports real users rarely touch, often starting abruptly.
Ruling out your own changes first saves the most time; most outages that feel like attacks are not.
How to check whether you are being DDoSed
- Check what changed. Deploys, configuration, DNS, campaigns, in the last hours.
- Check providers' status. Hosting, CDN, DNS; an upstream incident looks identical from inside.
- Compare traffic with a normal day. Volume, request rate, top paths, top sources, countries.
- Look at connection state. Half-open and idle connections against the usual count.
- Read the logs for patterns. Same path, same headers, same timing from many addresses.
If it is an attack, the next steps are on DDoS mitigation, and the discipline for emergency changes on incidents.
What a WAF activity log can and cannot show
A request filter's activity log records requests that matched a rule or a limit. During an application attack it shows which paths and categories were hit and from where, which is useful evidence.
It is not a traffic dashboard. It does not show bandwidth, connection counts or the traffic that was never flagged, and it sees nothing of floods that fill the link before requests exist. RFC 4732 explains why those layers need their own measurement.
Questions
How do I know if I am being DDoSed?
Rule out your own changes and provider incidents, then compare traffic, connection counts and request patterns with a normal day. Many uniform sources hitting the same targets, starting abruptly, point to an attack.
What does getting DDoSed mean?
It means your service is being made unavailable by a distributed denial-of-service attack: traffic or work from many sources at once that exhausts bandwidth, connection state or the application.
What are the signs of a DDoS attack?
A saturated link, connections that time out while bandwidth looks normal, or request rates rising on a few paths with errors and busy servers, depending on the layer attacked.
Can a WAF detect DDoS attacks?
It sees application-layer attacks as matched requests in its log. It does not see bandwidth or connection exhaustion, which need network and provider measurements.