The tremendous increase in the traffic volume of Web sites can be due to denial of service attacks or to a normal access that happens to occur at some time. How can a site determine that high traffic is reasonable? How can a web site distinguish between lack of capacity and a denial of service attack?