Determining the difference between a deliberate, malicious action and a non-malicious but nonetheless damaging action is difficult.
You see a large number of half-open connections in the
SYN_RECV state. Are you being SYN flooded or has someone you work with changed a firewall rule or outbound routing rule?
You see a large spike in the number of HTTP requests from a single IP address. Is it a badly behaved bot or a script kiddy trying to DoS you from his mother's basement? Or maybe an email just went out to all the students at a University with a link to your website.
You see a large spike in the number of HTTP requests from many IP addresses. DDoS or Reddit?
You see a large number of DNS requests from one IP address. Is that server trying to DoS you or is someone else spoofing the source address to make you part of a reflected DNS attack?
There can be several hints as to whether your site is down due to a deliberate attack or organic traffic. Some of these can be determined from logs, some only while the attack is happening.:
As Jeff Ferland mentioned, a valid
Referer header is a good hint that the traffic is legitimate however this is not absolute proof. A mildly popular page with hundreds of hidden images hotlinked from your site could be a method of initiating a DDoS. It doesn't even have to be images, any page will do.
<img href="http://target-site.com" /> will still cause the client to load that page from your web server but display a broken image icon. If you find referrers, check out the page if you can and make sure it's really legitimate.
Email clients don't usually set a referrer but webmail clients do. Although you won't be able to see the email simply by loading the referrer, the fact that there is one suggests it is a legitimate request.
User-Agent header can be a good clue. Most legitimate bots use unique user-agents with a link to an about page. Lots of not-so-legitimate bots (spam bots and email scrapers) use IE 6.0 as their user-agent. Most DoS tools contain a list of real but older user-agents from the most popular browsers that they rotate after each request. If you know the normal ratios of the different versions of each browser on your website, large spikes of Firefox 7.0.1 and IE 8.0 should stand out clearly. Especially since Firefox and Chrome auto-self-update now, seeing a version that's even a month old is rare.
If-None-Match since these largely defeat the purpose of making the request. If you see a lot of clients exhibiting this behaviour it's likely to be malicious. (As long as your cache controls are set up correctly.)
DoS tools often don't send the same headers as normal web browsers. Run a
tcpdump on your server to capture some traffic and analyse it. Some differences I have seen in bots (not necessarily DoS tools):
Host: header last instead of first. Normal browsers seem to list it right after the GET.
- POST data not correctly URL-encoded. Some real browsers such as IE6 don't get this right either.
- Specific and unique
Accept-*: headers. Chinese and Russian languages jumped out at me but this is anecdotal, not statistical.
- No Cookies.
Some headers can be clearly malicious, such as a
Range: header that lists thousands of overlapping ranges.
If you have mod_forensic switched on you may be able to analyse these headers after the attack however mod_forensic can produce a lot of data in your logs and this could cause a DoS on its own.
As for the reflected DNS attack, it's pretty much impossible to tell by simply analysing the traffic. You will have to go out-of-band to figure this one out. Find out who owns the IP address and email them or phone them and ask if they really are making all those DNS requests.
Which brings me to the out-of-band methods of figuring out malicious intent. Often, there is a reason behind a DoS attack. Google can help you find that reason. Search for your domain name (but remove results from that domain with
-site:yourdomain.com) and/or IP address and limit the results to the most recent ones. You may find evidence of the attacker boasting about taking you down or a tweet from @anonops signalling that you are the current target. You might also find the Slashdot story that mentions you. Either way, searching for your website may work. Don't forget the other search engines too, they all have their own crawlers and since you're looking for results from within the last few hours none of them will have complete coverage.
Some DoS attacks are based around extortion. Particularly against sites with a lot of money and specific, scheduled events such as gambling sites. The normal method is to generate a short DoS a week or two before the Super Bowl or the Grand National and follow it up with a threat that they'll do it again at the critical period if they aren't paid off. If you receive an extortion request, it's probable that the DoS was deliberate and malicious.