During a DDoS attack, you will notice multiple instances of the same IP address connected to one server port, timing out the connection. Here's an example of such an instance: Example of web server log during DDoS attack - source: loggly.com You can narrow your filter to only list HTTP...
and we both pulled over to check for damage. We were calm and I asked her why she had stopped so abruptly when she had the right of way, but she couldn't understand me. A Hispanic man nearby kindly translated for us.