I wonder what is the volume of traffic, in terms of requests/second, forms a legit DDoS attack against a website. I know it highly depends on the website and where it is hosted. But is there any real-world example that at least gives some numbers. For example, for 10M request/second, what size of website can be taken down?
I can only find some online news such as GitHub Survived the Biggest DDoS Attack Ever Recorded, but it is not very easy to interpret the unit they use, i.e., 1.3 Tbps, into number of HTTP requests from technical point of view. If interpret literally, one regular HTTP request include tens of headers that may range from few hundreds to few thousands of characters, and then count for a few thousands Bytes and then tens of thousands bits. If calculate this way, assuming a request is with size 5Kb on average, then 1.3 Tb would be roughly 200 million requests. But I don't think it is the right way to consider.