[Loki123]

Even if everything you said in that post was true (probably isn't, but let's say it was true for the sake of this post), it doesn't change the fact that most actual application layer floods are performed by people who know what they're doing and/or sophisticated scripts to do it for them. Your claim that mitigating layer-7 floods is easy because it's all going to be from the same IP is completely false. Even skids know that the requests in an l7 flood are (or should be, at least) sent from different IP address to avoid that kind of mitigating. Furthermore, the requests sent in the attack aren't all the same, otherwise you're right, it would be easy to mitigate. But that's just not how the world works.

If you don't believe me or still think I'm wrong, go look at some packet captures from victims of actual layer-7 floods. I hate to sound arrogant, but you'll find that I'm right.

You do realize that i never said you were wrong, incorrect or anything a like. You are imagining that part. I assume you have never seen one in action because it is relatively easy to mitigate these attacks, they don't flood your connection, meaning you can alter the firewall to match the package. The ip was an example, not near always the exact match to a pattern but a pattern always exist that you use to mitigate the attack.

Again, i never said you were wrong, that part is in your head. And everything you said doesn't change the point of a php script not being the appropriate method. I've mentioned two method better which was my original point. Firewall and cloudflare.

Edit: actually, you are wrong. On the part where you said I don't know how live application layer attack is.. That part is just dumb post that holds no value in the thread either way.