DDoS investigation — quick-start

checklist

1. activate scrubbing center, CDN DDoS mode, or ISP null-route — traffic diversion before attribution.
2. export firewall and netflow logs for the attack window — export now before circular log buffers overwrite.
3. record attack start and peak times in UTC — not local time, and not 'around noon'.
4. pull BGP routing table snapshot — hijacking and route injection attacks look like DDoS initially.
5. export DNS query logs from authoritative and recursive resolvers — amplification attacks surface in query ratios.
6. capture pcap sample if you can do so without saturating storage — 60-second sample at the edge is enough for signature extraction.
7. identify attacking source IPs and ASNs — note whether they cluster in one ASN (botnet rental) or are globally distributed (botnet).
8. pull your own app server error logs for the attack window — application-layer attacks target specific paths, not all traffic.
9. notify your ISP upstream and file a BGP community block request if the source is narrow enough.
10. begin the primary tool path below — netflow analysis and amplification source classifier.

primary tools

1. 01pcap readerdrop a .pcap or .pcapng · parse packets · filter by protocol · extract HTTP · DNS · plaintext credentials · runs locally
2. 02pcap / pcapng analyzerdrop a pcap or pcapng file · packet list · protocol breakdown · tcp stream reconstruction · dns queries · http requests · connection graph · runs locally
3. 03netflow analyzerdrop netflow v5 v9 or ipfix exports · traffic patterns · top talkers · protocol distribution · geographic connections · runs locally
4. 04PCAP network flow reconstructordrop pcap or pcapng file · parse all packets · reconstruct tcp and udp flows · compute flow statistics · surface top talkers unusual ports and flow anomalies · runs locally
5. 05network flow anomaly detectordrop pcap pcapng or zeek conn log · apply statistical anomaly detection to network flows · surface outliers in byte count duration connection rate and port usage · identify scanning exfiltration and tunneling anomalies · runs locally
6. 06tls ja3 fingerprinterdrop a pcap file · extract tls client hellos · compute ja3 fingerprints · identify known clients and malware · database of known fingerprints · runs locally
7. 07passive os fingerprinter from pcapdrop a pcap file · reconstruct the operating system of every host from tcp/ip stack behavior · ttl values · window sizes · tcp options ordering · ip flag patterns · no active probing · identify os from existing captured traffic · runs locally
8. 08nginx / apache log analyzerdrop access.log · parse combined log format · top IPs · paths · status codes · user agents · detect scanning · brute force · 404 storms · runs locally

go deeper