Average packet size: While large packet sizes might be unusual, it,s not a definitive indicator of DoS attacks.
Total number of connections: Can be high during normal traffic bursts, not solely indicative of DoS attacks.
Average response time: Increases during high traffic but doesn,t directly pinpoint the cause (DoS or legitimate surge).
Number of connections per second: A sudden and sustained spike in connection attempts per second is a strong indicator of a DoS attack aiming to overwhelm the server with connection requests.
Additional metrics helpful for identifying DoS attacks:
Source IP addresses: Analyzing the origin of connection attempts can reveal suspicious patterns or known attacker IPs.
Destination ports: Attacks might target specific ports used by your web server applications.
Error codes: Increased occurrences of connection refused or reset errors could indicate DoS attempts.