How can webmasters determine whether a website is under DDOS attack based on experience?

After years of experience in website attacks, I was confused at the beginning. Later, I learned some methods to determine attack types.
Today, I would like to share with you the three methods of determining DDOS attacks. I have summarized my own experiences and can share with you any good ideas.
1. Determine the Data Interaction speed with the server. For example, run the ping command.
Ping www.sina.com-t
It means that the system keeps sending data to the website service and receiving data from the server. Normally

From the data returned above, the data interaction is normal, only about 7 ms, fast, and stable connection.
However, when the website server is attacked, a large return value may occur, and even no response is returned at all.

2. view the network connection status of the server, for example, using the netstat-an command
For normal web servers, the number of concurrent online users is limited, for example, using the netstat command
If the number of connections on the server exceeds several normal times, a large number of statuses such as SYN_RECEIVED and TIME_WAIT will occur.

3. Check the status through website server logs. For example, APACHE log analysis.

The above is my personal experience and I hope it will be useful to you.
Author: EeSafe Web security alliance http://www.eesafe.com/bbs/thread-504-1-1.html