Hi, its kinda <s>stupid</s> incorrect way of detecting ddos by reading http responce. if server says error 408, it could be just a script which takes long to complete. if there is some caching server, e.g. nginx, before actual web server, e.g. apache httpd, then error 502 could be a result of any apache death, not a ddos attack. but if you still want to monitor sites in such "unusual" way, and if you have access to web-servers' serverstatus, you'd could parse them to find out: amount of simultaneous requests; similar requests by IP; similar requests by Requested Page; etc.
-- Cheers, Kai _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
