When your server is under attack, "we're being DDoSed" is not actionable; "SYN flood, four million packets per second, spoofed sources, targeting port 443" is. The difference between the two is a thirty-second packet capture and a structured look at it. This guide covers capturing safely on a machine that's already saturated (tcpdump, not the Wireshark GUI), the triage workflow in Wireshark (Protocol Hierarchy, Conversations, I/O Graphs) and the display-filter signatures of the common attack vectors, ending with how to turn findings into mitigation.

DDoS attacks come in three broad families: volumetric floods that saturate your pipe, protocol attacks that exhaust connection state, and application-layer floods that look like legitimate traffic. Each one exhausts a different resource, so each one needs a different defence, and no single layer stops all three. This guide maps the common attack forms to the resource they target and the mitigation that actually works against them, explains what an on-host firewall can and cannot stop, and ends with a practical incident-response runbook for when your server is under fire.