Recently I used a tool to download a website and as part of the tool one could adjust the number of parallel connections. So now I found myself asking: starting from how many requests a provider could rate it as a denial of service. I googled around however didn't find specific numbers or at least hints about what dimensions we are talking about. Is there any definition e.g. like 100 requests a second?
So my question is: How many requests are needed to state that a denial of service is in progress?
Update: the technical background is definitely of interest. I understand that one malicious packet could be enough to cause a denial of service or the slashdot effect is another. But what I wanted to know was more of a firewall style rule: Some servers / service providers block out users which send too many requests in a certain time frame. About what dimension are we talking about here? Or is that too specific? If so what would your rule look like?
The question also had a legal component - let me illustrate a high(!) theoretical scenario:
A provider of a service checks its logs and sees that there has been high traffic from a single IP. Now the provider goes to court (for whatever reason) and labels this as an attempted denial of service. The judge would probably ask for their definition of a DoS. "Anything beyond the normal usage" would be their answer. So where is the threshold between normal usage and "none" normal usage (which could be interpreted as an attempted DoS even if the server remains totally unimpressed and this is probably a highly constructed scenario ;-)