Concepts

Halberd operates in stages:

1. Initially, it sends multiple requests to the target web server and records its responses. This is called the sampling phase. The time to spend in this phase and the amount of HTTP requests to be sent can be specified using the -time and -parallelism command line options. See 4.2.5 and 4.2.6.

2. After the analysis phase finishes, either normally or because the user interrupted it pressing Control-C, the program processes the replies looking for signs of load balancing. This is called the analysis phase.

3. Finally, halberd writes a report of its findings to the screen (or to a file if the -out option is used).

The user may skip the scanning phase and proceed to the analysis of samplings saved in a previous session. See 4.2.10 and 4.2.11.

The following is a list of detection techniques currently implemented: