How to Check for DDoS Using `top`
1A sysadmin can use the top command to check for signs of a DDoS (Distributed Denial of Service) attack by looking at several key metrics and indicators. Here's how to do it:
Load Average: Look at the load average in the top command. A significant spike in load average can indicate a DDoS attack.
High CPU Usage: If a process is using an unusually high amount of CPU, this could be a sign that the server is under attack. Look for processes that are consuming the most CPU.
High Memory Usage: Check for processes that are using a large amount of memory. This could indicate an attempt to exhaust the server's resources.
Network Usage: Although top doesn't directly show network usage, high CPU usage by network-related processes (like httpd, nginx, or sshd) can be an indicator of a DDoS attack.
Zombie Processes: A high number of zombie processes (defunct processes) might indicate that the server is overwhelmed and can't handle all the incoming requests.