What are common indicators of a DDoS attack visible within a pcap file?

Common indicators of a DDoS attack detectable in a pcap file include: 1) High packet rates towards a specific destination IP or port; 2) Unusual packet sizes (either consistently very large or very small); 3) A large number of SYN packets without corresponding ACK packets (SYN flood); 4) UDP floods characterized by a high volume of UDP packets; 5) ICMP floods with a large number of echo requests (ping flood); 6) Fragmentation attacks with numerous fragmented packets; and 7) Unusual flag combinations (e.g., all SYN flags set).