They tend to look like that in your Apache logs when they target at the web application level. Once you're flooded and your process load spikes, you can't see

They tend to look like that in your Apache logs when they target at the web application level. Once you're flooded and your process load spikes, you can't see what your web server has run out of workers to handle. Netstat will give you a better picture as far as IPs/connections once you get the process load down so you can actually run anything.