How to tell if you're being DDoS'd
in 30 seconds

Back to Blog

The Problem: You Think You Might Be Under Attack

Something is wrong with one of your servers. Load is spiking, connections are timing out, and your uptime monitor just went red. It could be a DDoS attack. It could be a viral post on Hacker News. It could be a runaway cron job. You need to know which one it is, and you need to know right now.

Most people reach for iftop or tcpdump at this point. Both work, but neither gives you a quick answer to the question that matters: is this a DDoS attack, and if so, what kind?

iftop shows you connections and bandwidth, but it won't tell you that 90% of your inbound traffic is UDP port 53 from thousands of unique source IPs. tcpdump gives you raw packets, but scrolling through packet dumps while your server is drowning is not a productive use of your next 30 seconds.

Step 1: Install NetHawk (10 Seconds)

NetHawk is a free, open-source terminal tool that captures packets from your network interface and displays real-time traffic analysis with attack classification. One binary, no config files, no accounts.

curl -sSfL https://raw.githubusercontent.com/Flowtriq/nethawk/main/install.sh | sudo sh

That's it. If you prefer installing from source:

go install github.com/Flowtriq/nethawk/cmd/nethawk@latest

On Debian/Ubuntu you'll need libpcap-dev if it's not already installed. On RHEL/CentOS it's libpcap-devel. macOS has it built in.

Step 2: Run It (5 Seconds)

sudo nethawk

That's the entire command. NetHawk auto-detects your primary network interface and starts capturing immediately. If you want to specify an interface:

sudo nethawk -i eth0

The TUI appears instantly. You're now looking at a live dashboard of everything hitting your server.

Step 3: Read the Dashboard (15 Seconds)

Here's what to look at, in order:

1. Severity indicator (top of screen)

If NetHawk shows NORMAL in green, your traffic is below the attack threshold. If it shows MEDIUM, HIGH, or CRITICAL in yellow/orange/red, you have a problem. The default threshold is 50,000 packets per second. Adjust with -t if your server normally handles more than that.

2. Bandwidth and PPS

The top section shows current packets per second and bandwidth. A web server getting 200 Mbps of inbound traffic when it normally gets 20 Mbps is a clear signal. NetHawk shows both current and peak values, so you can see if the spike already passed or is still climbing.

3. Protocol breakdown

This is the single most useful thing on screen during a potential attack. Normal web server traffic is overwhelmingly TCP. If you see UDP at 80% or higher, that's almost certainly an amplification attack. If ICMP is dominant, it's an ICMP flood. A healthy protocol distribution for a typical web server looks like 90%+ TCP, a few percent UDP (DNS queries), and minimal ICMP.

4. Top source IPs

If your top source IPs are sending wildly disproportionate traffic, you can see them ranked right here. During an amplification attack, you'll see open resolvers and NTP servers. During a botnet attack, you'll see thousands of unique IPs each contributing a small share.

5. Top destination ports

This tells you what's being targeted. If port 80/443 is eating all the traffic, it's aimed at your web service. If port 53 dominates inbound, you're receiving DNS amplification. If it's port 123, NTP amplification. NetHawk labels the common attack vectors automatically.

6. Attack classification

When traffic exceeds your threshold, NetHawk doesn't just say "attack detected." It tells you the type: DNS Amplification, NTP Amplification, SYN Flood, UDP Flood, Memcached Amplification, and others. This saves you the step of manually correlating protocol and port data to figure out the vector.

Bonus: JSON Output for Scripting

If you want to pipe the data somewhere or log it for later analysis:

sudo nethawk -json | tee /tmp/traffic-capture.json

Every second, NetHawk outputs a JSON object with all the metrics: PPS, BPS, protocol percentages, top sources, top ports, severity, and attack classification. Pipe it to jq, feed it to your log aggregator, or write a quick script that sends a Slack alert when severity goes above NORMAL.

# Quick example: alert to Slack on severity change
sudo nethawk -json | jq --unbuffered 'select(.severity != "NORMAL")' | while read -r line; do
  curl -s -X POST "$SLACK_WEBHOOK" -d "{\"text\": \"$(echo $line | jq -r '.severity + \" - \" + .attack_type')\"}"
done

What You've Learned in 30 Seconds

After those 30 seconds, you know:

• Whether you're actually under attack or just seeing a legitimate traffic spike
• The current bandwidth and packet rate hitting your server
• The protocol mix (TCP vs UDP vs ICMP)
• Which ports are being targeted
• Which IPs are sending the most traffic
• The specific attack vector (DNS amp, SYN flood, etc.) if one is detected

That's enough information to make a decision: do you need to start dropping traffic with firewall rules, call your upstream provider, or just wait for the Hacker News wave to pass?

When You Need More Than Visibility

NetHawk tells you what's happening. It's a diagnostic tool. You SSH in, run it, see the problem, and act on it manually.

That works well for investigating a single incident on a single server. But there are situations where manual investigation isn't enough:

• You have dozens or hundreds of servers. You can't SSH into every one of them during an attack. You need centralized monitoring that watches all of them simultaneously and alerts you when any node goes anomalous.
• You need automated mitigation. If an attack hits at 3 AM, you want firewall rules deployed automatically in seconds, not after someone wakes up and starts debugging.
• You need historical baselines. NetHawk shows you the current state. It doesn't know what "normal" looks like for this server on a Tuesday at 2 PM. Per-node baselines that learn your traffic patterns reduce false positives and catch attacks that would fly under a static threshold.
• You need incident forensics. After the attack ends, you want full PCAP captures, timeline analysis, and attack reports. Not just "yeah, it was a SYN flood."

That's what Flowtriq does. It runs an agent on every server that continuously monitors traffic, builds per-node baselines, detects anomalies, classifies attacks, deploys firewall rules or FlowSpec automatically, captures PCAPs, and sends alerts to Slack, PagerDuty, or wherever your team watches. One dashboard for your entire fleet.

Think of it this way: NetHawk is the stethoscope. Flowtriq is the ICU monitor with automated intervention.

Back to Blog

Related Articles