Posted by Kai on Jun 26
Hi,
its kinda <s>stupid</s> incorrect way of detecting ddos by reading http
responce.
if server says error 408, it could be just a script which takes long to
complete. if there is some caching server, e.g. nginx, before actual web
server, e.g. apache httpd, then error 502 could be a result of any
apache death, not a ddos attack.
but if you still want to monitor sites in such "unusual" way, and if
you have…
Source: Re: how to detect DDoS attack through HTTP response analysis(throuput)
