This is an application-layer (L7) attack, not a network flood: every request is a real, well-formed HTTP request, so filtering by source IP or raw packet volume does nothing — the traffic looks legitimate.
- Slowloris bots open a connection and trickle it forever, holding one of the server's limited connection-pool slots without ever finishing. They barely touch the CPU — the pool empties out from underneath, not the processor.
- HTTP-flood bots request something expensive (a heavy search query) and finish fast, so they cycle through slots quickly but spike CPU hard on every hit.
- Behavioural WAF holds every request at a checkpoint ring and scores it — challenge execution, click/timing cadence, browser fingerprint — instead of counting requests per IP. Scripted bots fail that check almost every time; real users pass with a small delay.
- Toggle the WAF on and off mid-attack, or adjust its strictness, and watch the pool and CPU gauges recover once bot traffic is scored out before it ever claims a slot.