HTTP flood attacks use standard URL requests, hence it may be quite challenging to differentiate from valid traffic. When the servers’ limits of concurrent connections are reached, the server can no longer respond to legitimate requests from other clients attempting to connect, causing a denial of service.

There are also more exotic attacks which may utilize other HTTP methods such as PUT, DELETE etc. HTTP floods are designed to overwhelm web servers’ resources by continuously requesting single or multiple URL’s from many source attacking machines, which simulate a HTTP clients, such as web browsers (Though the attack analyzed here, does not use browser emulation).Īn HTTP Flood may consist of either GET (images and scripts), POST (files and forms) or combined GET and POST requests. The HTTP protocol – is an Internet protocol which is the basis of browser-based Internet requests, and is commonly used to send form contents over the Internet or to load web pages. Layer 7 is the application layer of the OSI model. HTTP flood is a layer 7 DDoS attack that targets web servers and applications.

When wireshark captures an attack