Question

how can a website distinguish between lack of capacity and a denial-of-service attack? for example, websites often experience a tremendous increase in volume of traffic night after an advertisement with site's url in shown on television during a broadcast of a popular sporting event. that spike in usage is the result of normal access that happens to occur at the same time. how can a site determine that high traffic is reasonable?

Answer 1

First of all the company must have a sligh idea about the traffic generated at its website and they must record that data and then they must monitor the spike in traffic after any advertisement or campaign regarding their website by doing this one can have a clear idea about the nature of traffic generated at its website for example if there is a shopping website then it is seentseen one thousand people logged in an hour during shopping festival however when they see a traffic of ten thousand people in an hour then they must realise that something is fishy and genuine user actually spend some time in the website while a bot or an attacker would only create null requests in a DoS attack and one must monitor their web server log for any suspicious activity.In this way we can determine whether it is a DoS attack or lack of capacity