httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Paul Querna <>
Subject Re: httpd-2.1.3-beta under a large DDOS attack ... not good.
Date Mon, 14 Mar 2005 22:21:42 GMT
I think it is slightly deceptive to say 2.1.3-beta doesn't handle a DDoS 
attack very well -- 1.3.x or 2.0.x would not do any better. wrote:
> *long but interesting, I hope*
> ....

Few comments:

1) There was a memory leak in the core_input_filter.  It has been fixed 
in /trunk/, but was still present in 2.1.3-beta and 2.0.53.  This should 
stop the leak from sending one-character at a time:

 > I had to kill and restart apache every 50 seconds.

2) That won't help Apache performance.  If you are running out of ram, 
lower your max clients, or get more RAM.  Killing apache will force 
apache to reallocate RAM from the OS.. you want to reach a steady state. 
But, I guess since your older version did have a memory leak, nothing 
else could be done.

3) The Event MPM Might handle this load better, since it could pass off 
the one-char a second requests to the event thread.

 > * Apache2 can handle 16000 active open connections on a reasonable sized
 > box, at least if they are all bogus and going to be rejected, without
 > recompilation of glibc.

!6,000 isn't a problem, if you have more RAM. (2gb won't cut it, I think).

 > * More than one kind of timeout can be set. For example, I would have
 > liked to have set a request phase timeout of 0.5 seconds or a total
 > request phase timeout of 2 seconds (not an idle timeout of 1 second).

I agree, a total request phase timeout could be useful.

 > * A flag for rejecting slow writers or peculiar ones (malformed garbage
 > gets you kicked sooner).

Sometimes it is hard to decide.  Is it a DDoS client, or just a user on 
a 14.4 modem?

 > * Graceful non-crashing behavior when thread resources of one kind or
 > another are exceeded.

I don't believe there is a 'graceful' way to handle Out-Of-Memory 
conditions.  Suggestions are welcome.

Thanks for the interesting email.


View raw message