Which of the following would BEST detect that a distributed-denial-of-service attack (DDoS) is occurring?