We are flooded with web request on our site which appears to be DOS attack.
- it is all on port 80
- the distribution of packet sizes is NOT normal web traffic
- 33% of packets are 64 or 66 bytes
- 75% of packets are 128 bytes or less
- 99% of packets are less than 256 bytes
- we are running around 10K packets / second
- during a 5 second window, we saw web requests from 822 distinct IP addresses
- all requests are for / (the home page)
we tried switching the IP address but unfortunately attack is happening on domain name level and not IP level...
any help would be appreciated.