Timeline for What packet parameters should be checked to detect layer-7 DDoS attack?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 16, 2014 at 17:17 | comment | added | pacifist | I'm not sure you've understood. Layer 3 is like a river of boats, all of the same design, some painted different colours. Layer7 is the people within the boats. Nothing about the boats tells you the kind of people inside; to understand that you need to look inside (at a different layer). If it's your web server being attacked like in the example I gave, they may have the same pattern at layer3 as legitimate traffic (i.e. sending requests to port 80). It's only when you break open the layer3 encapsulation, and look at the conversation in more depth that you can see something's wrong. | |
| Mar 14, 2014 at 9:34 | comment | added | arin1405 | Thanks for your explanation. I would like to know if there is any way to detect layer-7 attack (as examples are given above) from traffic characteristics. Yes, the windows size comes in tcp packet format which is a layer-3 protocol and tcp packet parameters help a lot in detecting layer-3 attack from packet trace. But is there any such thing to monitor for detecting layer-7 attack? | |
| Mar 14, 2014 at 7:44 | history | answered | pacifist | CC BY-SA 3.0 |