Excess legitimate web traffic. Thousands or even millions of clients connecting to the website in a short amount of time, e.g., Slashdot effect. Distributed Denial of Service attacks. A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer or network resource unavailable to its intended users. Computer worms that sometimes cause abnormal traffic because of millions of infected computers (not coordinated among them). XSS worms can cause high traffic because of millions of infected browsers or web servers. Internet bots Traffic not filtered/limited on large websites with very few network resources (e.g. bandwidth) and/or hardware resources (CPUs, RAM, disks). Internet (network) slowdowns (e.g. due to packet losses) so that client requests are served more slowly and the number of connections increases so much that server limits are reached. Web servers, serving dynamic content, waiting for slow responses coming from back-end computer(s) (e.g. databases), maybe because of too many queries mixed with too many inserts or updates of DB data; in these cases web servers have to wait for back-end data responses before replying to HTTP clients but during these waits too many new client connections / requests arrive and so they become overloaded. Web servers (computers) partial unavailability. This can happen because of required or urgent maintenance or upgrade, hardware or software failures such as back-end (e.g. database) failures; in these cases the remaining web servers may get too much traffic and become overloaded. Symptoms of overload The symptoms of an overloaded web server are usually the following ones (e.g.). Requests are served with (possibly long) delays (from 1 second to a few hundred seconds). The web server returns an HTTP error code, such as 500, 502, 503, 504, 408, or even an intermittent 404. The web server refuses or resets (interrupts) TCP connections before it returns any content. In very rare cases, the web server returns only a part of the requested content. This behavior can be considered a bug, even if it usually arises as a symptom of overload. Anti-overload techniques To partially overcome above average load limits and to prevent overload, most popular websites use common techniques like the following ones (e.g.). Tuning OS parameters for hardware capabilities and usage. Tuning web server(s) parameters to improve their security and performances. Deploying techniques (not only for static contents but, whenever possible, for dynamic contents too). Managing network traffic, by using: