In that case, I don't think your metric works at all, since legitimate users will increase it, but attackers won't. During an attack it will either remain the s

In that case, I don't think your metric works at all, since legitimate users will increase it, but attackers won't. During an attack it will either remain the same, or even go down as fewer legitimate users manage to connect. This attack is the QUIC equivalent of a SYN flood, which results in half-open connections, because the attacker is unable to complete the connection by responding to message the server sends. RequireAddressValidation corresponds enabling syn cookies. Unfortunately I don't use caddy myself, and don't have time to get involved deeper in improving this.