Which method helps identify the source of DoS traffic and allows administrators to recognize the type of DDoS attack or combination used?

Which method helps identify the source of DoS traffic and allows administrators to recognize the type of DDoS attack or combination used?

• A. Event Log Analysis
• B. KFSensor
• C. Rate limiting
• D. RFC 3704 Filtering

Answer: (A)

Identifying the source of DoS traffic and understanding the attack type relies on analyzing and correlating event logs from across the network. By collecting timestamps, source IPs, connection counts, and alert data from firewalls, routers, load balancers, IDS/IPS, and servers, administrators can trace where the traffic originates, see patterns of activity, and determine whether the attack is coming from a single source, multiple sources, or a botnet. This approach also helps distinguish attack types. A volumetric flood shows up as sustained, unusually large bandwidth with many sources; a protocol flood appears as abnormal consumption of specific protocol resources (like SYN, SYN/ACK, or ping floods); an application-layer attack reveals targeted, repetitive requests aimed at a particular service or endpoint. The strength of log analysis is the ability to piece together evidence from multiple devices to form a clear picture of both origin and technique, informing effective containment and remediation. Other methods don’t provide the same investigative insight. A honeypot like KFSensor can study attacker behavior in a controlled environment but isn’t a reliable source for real-time attribution across the network. Rate limiting mitigates impact but doesn’t identify who is attacking or classify the traffic. RFC 3704 Filtering reduces spoofed traffic at the edge, but it doesn’t reveal attack sources or the nature of the attack once traffic has entered the network.

Identifying the source of DoS traffic and understanding the attack type relies on analyzing and correlating event logs from across the network. By collecting timestamps, source IPs, connection counts, and alert data from firewalls, routers, load balancers, IDS/IPS, and servers, administrators can trace where the traffic originates, see patterns of activity, and determine whether the attack is coming from a single source, multiple sources, or a botnet.

This approach also helps distinguish attack types. A volumetric flood shows up as sustained, unusually large bandwidth with many sources; a protocol flood appears as abnormal consumption of specific protocol resources (like SYN, SYN/ACK, or ping floods); an application-layer attack reveals targeted, repetitive requests aimed at a particular service or endpoint. The strength of log analysis is the ability to piece together evidence from multiple devices to form a clear picture of both origin and technique, informing effective containment and remediation.

Other methods don’t provide the same investigative insight. A honeypot like KFSensor can study attacker behavior in a controlled environment but isn’t a reliable source for real-time attribution across the network. Rate limiting mitigates impact but doesn’t identify who is attacking or classify the traffic. RFC 3704 Filtering reduces spoofed traffic at the edge, but it doesn’t reveal attack sources or the nature of the attack once traffic has entered the network.