If an attack (DoS & DDoS) involves thousands of bots, how can the server distinguish them from legitimate clients?

closed as unclear what you're asking by Graham Hill, Xander, NULLZ, schroeder, TildalWave Nov 5 '14 at 15:35

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What kind of "attack" are you talking about? – Philipp Nov 5 '14 at 12:37
  • 1
    i am talking about DoS & DDoS Attacks! – Cert Nov 5 '14 at 14:30
  • Then please edit your question to say so. – Philipp Nov 5 '14 at 14:34
  • possible duplicate of How can I detect and block bots? – schroeder Nov 5 '14 at 15:29

It's going to vary for every single attack. With DoS attacks, you can looks for attributes that are different than "real" requests, say values that are out of range, or the lack or specific format of a particular piece of data like a user-agent or referer in a HTTP request.

Generally speaking for DDoS attacks, if the traffic gets to the server, you've lost, and it doesn't matter. DDoS attacks are purely designed to choke resources and the most common bottleneck is the network bandwidth. You can potentially identify characteristics of a DDoS attack, but it almost always needs to be identified and managed upstream so the traffic never reaches your servers.

  • Hi Xander, could you please explain some more on what's your mean by "but it almost always needs to be identified and managed upstream so the traffic never reaches your servers" ? – Hi I'm Frogatto Nov 9 '14 at 19:06
  • @ABFORCE A DDoS attack will often overwhelm the capacity of your network bandwidth, and with attacks getting larger and larger, they're more frequently many multiples of your bandwidth. When this is the case, it doesn't matter how obvious it is, it's already blocked the real traffic and by the time it gets to you it's too late. So, you need your ISP, your CDN, and their peers, the people who have the huge core pipes, to identify this traffic and stop it from being routed to you in the first place. – Xander Nov 10 '14 at 13:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.