Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Date: Wed, 24 Jun 2009 11:36:21 +0200
From: Andreas Krennmair <ak@synflood.at>
To: dev@httpd.apache.org
Subject: Re: Mitigating the Slowloris DoS attack
Message-ID: <20090624093621.GF5742@synflood.at>
References: <20090621111038.GA5742@synflood.at>
 <4239a4320906222148h1121a43ck99698939f8f8ed6d@mail.gmail.com>
 <20090624091858.GA5086@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Disposition: inline
In-Reply-To: <20090624091858.GA5086@redhat.com>
User-Agent: Mutt/1.5.18 (2008-05-17)

* Joe Orton <jorton@redhat.com> [2009-06-24 11:20]:
>Meh.  There will always be a maximum to the number of concurrent 
>connections a server can handle - be that hardware, kernel, or server 
>design.  If you allow a single client to establish that number of 
>connections it will deny service to other clients.
>
>That is all that "slowloris" does, and you will always have to mitigate 
>that kind of attack at network/router/firewall level.  It can be done 
>today on Linux with a single trivial iptables rule, I'm sure the same is 
>true of other kernels.

I think you confuse the PoC tool with the fundamental problem. You can't fend 
off this kind of attack at TCP level, at least not in cases where the n 
connections that block Apache are made by not 1 but n hosts.

Regards,
Andreas