httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brian Behlendorf <>
Subject Recommendation: change DEFAULT_TIMEOUT to much less than 1200
Date Sun, 22 Dec 1996 01:42:25 GMT

Since the error I reported last week where MSIE on Windows NT would spawn
innumerable connections to the server, forget they existed, with the impact of
soaking up all available children, we have turned down the "Timeout" directive
to 180, from the default, 1200.  Whereas before we were getting attacked on a
daily basis, in the three days since this change was implemented we have not
had a single swamp attack.  

Ed is working on code to limit the total number of simultaneous connections to
the server from a given address - this is the better long-term solution we
believe.  However, changing our default from 1200 to something much smaller,
like 180, may address the numerous problems I see mentioned on c.i.w.s.u
regarding "the server's locking up".  This is a hard problem for the average
webmaster to debug when it happens - they have to be smart enough to consider
doing a netstat -a, understand that 200 ESTABLISHED connections from the same
host is a problem, and then trace that host to the browser being used, and then
end up with the realization that there's little they can do about it.

Right now "Timeout" affects two situations where it really should only affect

1) The total amount of time to read a GET request
2) The time in between packets for a POST or PUT request
3) The time in between packets for a response

Each of these should be broken out into their own variables and directives, in
my opinion. 20 minutes is extremely generous, so generous it's killing us.
In a world where TCP/IP software behaves correctly and applications don't open
up and forget about 200 established connections it's not so bad; in today's
world, however, it's not sufficient.

I do not currently have the time before I go on vacation to write up the errors
we've seen with MSIE/NT in a document similar to the one created for the
AOL/HTTP issues.  Ed, if you want to do that, feel free - it would be
interesting to see if there was some way we could see if changing the timeout
had actually prevented these denial of service attacks over the last couple of



View raw message