A sudden traffic spike, spinning pages, API timeouts — these symptoms are not always a DDoS. Learning to tell them apart avoids wasting budget on a fake attack.
Look at where the traffic comes from
- Distributed sources: DDoS traffic arrives from thousands of different IPs, regions, even countries. A few high-frequency IPs are more likely a crawler or single-abuser abuse.
- Protocol mix looks wrong: normal traffic is mostly HTTP/HTTPS; a sudden surge of UDP, SYN, ACK, or ICMP packets points to volumetric or protocol attacks.
- Ratios break: when upload/download and requests/successful-responses go badly out of balance, that is usually an attack signature.
Check business metrics
| Metric | Normal | Suspected attack |
|---|---|---|
| Request volume | Explained by activity | Unreasonably 10x plus |
| Error rate | Low, stable | 5xx / timeouts spike |
| Source IPs | Real user base | Many unfamiliar networks |
| Connections | Matches user scale | Connection table full |
Key: if request volume spikes together with error rate up and source dispersion up, it is essentially an attack.
Volumetric, protocol, or application layer?
- Volumetric: bandwidth saturated, often UDP / reflection amplification (NTP, DNS, SSDP, Memcached).
- Protocol: bandwidth may be fine, but SYN / ACK Flood exhausts the connection table or firewall.
- Application layer (CC): traffic looks normal yet burns database, login, or search; hard to spot with simple rules.
Quick checklist
- Do you see distributed sources plus rising errors plus saturated bandwidth or connections together?
- At the same moment, can real users not reach the site at all?
- After limiting a single IP rate, does overall pressure drop noticeably?
All three means almost certainly a DDoS or CC attack. Next, see What to Do When Your Site Is Under a DDoS Attack.
Why detect early?
One minute earlier equals one minute earlier to scrub equals one minute less loss. Still evaluating protection? See Free or DIY DDoS Protection vs Professional, or contact us for a free assessment.