Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (hermes.apache.org: local policy)
Message-ID: <42641792.70105@Ivn.cl>
Date: Mon, 18 Apr 2005 16:24:50 -0400
From: "Ivan Barrera A." <Bruce@Ivn.cl>
Reply-To: Bruce@Ivn.cl
Organization: Ivn Systems/Software
User-Agent: Mozilla Thunderbird 1.0 (X11/20041206)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Reading byte to byte from client request
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi. I'm new to the list, and i hope not to be posting out of topic.

  I've been trying to do this (read byte to byte the client request) 
since a while, with no success. I've asked in the modules list also.
  My idea is to be able to know the time between every char that 
arrives. Why? because we've been atacked with some ddos script that 
opens a socket, put a chat, wait a second, put another char, and so on. 
I reproduced this script, and it works, consuming all http childs (or 
threads) and noone is able to see my sites anymore.
  Well. I've developed a mod that helps with this, but it still isn't 
able to detect this kind of attack. I've read a lot, followed the source 
code, and still don't understand where to put my filter (if there is any 
place to do this) so i can get access to the "stream".

  On another mod, i also want to do this, but in the output. So i can 
determine the speed the client is downloading. (so i can make a better 
bandwidth management mod).

  could anyone tell me where to look ? or some example on how to do it ?
or simply.. if it cannot be done?

  Thanks a lot for taking the time to read this.

Bruce.-