What would prevent a DoS attack?

Did my site get a DoS attack?

• How do I tell whether my site was hit by a denial of service attack? [Server logs inside.] Background: My friend and I run the website for a campus political party at our university. Elections started at midnight last night. We heard that the other guys were planning to try a DoS on our site, http://www.michiganprogressiveparty.com. Here are the logs: http://joeygolden.com/stats1.pdf http://joeygolden.com/stats2.pdf We think that someone was requesting the same image (mpptop.gif) a lot. I changed the around 1am, not sure if that stopped it (if there was ever an attack in the first place). I'm not skilled with this sort of IT stuff, so I thought I'd ask here. Is there good evidence in our logs that a DoS attack occurred?

• Answer:

  These reports aren't particularly useful. Do you have access to the underlying log files? They'll be text files with a separate line for each request against your server. It does look like mpptop.gif was requested far out of proportion to everything else on your site. It was requested over 200K times, while it looks like your HTML pages were only requested ~16K times. Even if the gif was referenced multiple times per page, I'd expect it to be cached on the browser side. The major candidate is this host: stockwell-205-56.reshall.umich.edu, which accounts for 50% of the traffic on your site this month. These hosts might also have been participating: bursley-220-81.reshall.umich.edu bursley-216-26.reshall.umich.edu It seems unlikely to me that the level of traffic you were hit with would have mounted an effective denial of service, unless your website is hosted on a Palm V. It's not looking particularly distributed either, but it does look like someone may have made a lame attempt to knock you site off-line. If you have access to the raw server logs for yesterday, it will be much more obvious what really went on in the evening. If it shows evidence of a traffic flood from one of those hosts then campus IT will probably be able to check DHCP logs to narrow down the computer associated with those IP addresses at the times in question, and may be able to identify which room was involved. Whether they will or not is another question.