How to Detect a DDoS Attack on a Linux Server via CLI Tools
When your Linux server load suddenly spikes, guessing the cause is not an option. Your websites slow down, APIs time out, and even your SSH connection might begin to lag. In these critical moments, you need to know immediately whether you are dealing with a legitimate traffic surge, a misbehaving internal application, or a Distributed Denial-of-Service (DDoS) attack. This tutorial provides a hands-on, step-by-step guide to diagnosing malicious traffic using standard Linux command-line utilities. 1. Monitor Network Interface Traffic (Volumetric Attacks) The most common form of a DDoS attack is a volumetric flood. Before digging into your web server logs, you should check the raw traffic hitting your network interfaces. Monitor Real-Time Bandwidth with iftop Run the following command: sudo iftop -n (Note: The -n flag prevents DNS resolution, which is crucial during an attack because DNS lookups will severely slow down the tool) Check Packets Per Second (PPS) with sar ...