What packet parameters should be checked to detect layer-7 DDoS attack (http flood, slow http request etc.)? Do window size and packet timeline show enough information to detect attack traffic from legitimate traffic? What are the other parameters need to be verified?
1 Answer
could you supply more info. Parameter's in what app/system?
The things you're talking about (packet features) are layer-3 (packet level) features.
These have nothing to do with whatever's happening at layer 7 (application) level - different things can be happening at the different layers with no relation, and an attack mostly working at layer 7 (like someone spamming, say, a search field in your website) won't necessarily have any defining features at layer3. If it does, it could likely be easily changed on their side without changing the rest of the attack.
-
Thanks for your explanation. I would like to know if there is any way to detect layer-7 attack (as examples are given above) from traffic characteristics. Yes, the windows size comes in tcp packet format which is a layer-3 protocol and tcp packet parameters help a lot in detecting layer-3 attack from packet trace. But is there any such thing to monitor for detecting layer-7 attack?– arin1405Commented Mar 14, 2014 at 9:34
-
I'm not sure you've understood. Layer 3 is like a river of boats, all of the same design, some painted different colours. Layer7 is the people within the boats. Nothing about the boats tells you the kind of people inside; to understand that you need to look inside (at a different layer). If it's your web server being attacked like in the example I gave, they may have the same pattern at layer3 as legitimate traffic (i.e. sending requests to port 80). It's only when you break open the layer3 encapsulation, and look at the conversation in more depth that you can see something's wrong.– pacifistCommented Mar 16, 2014 at 17:17