Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of dirkx@webweaving.org
 designates 213.207.101.183 as permitted sender)
Message-ID: <4A41DBA5.1070509@webweaving.org>
Date: Wed, 24 Jun 2009 08:54:13 +0100
From: Dirk-Willem van Gulik <dirkx@webweaving.org>
User-Agent: Postbox 1.0b12 (Macintosh/2009051120)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Mitigating the Slowloris DoS attack
References: <C666EB03.C0E5A%Brian.Akins@turner.com>
In-Reply-To: <C666EB03.C0E5A%Brian.Akins@turner.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Akins, Brian wrote:
> On 6/22/09 10:40 PM, "Weibin Yao"<nbubingo@gmail.com>  wrote:
>
>> I have an idea to mitigate the problem: put the Nginx as a reverse proxy
>> server in the front of apache.
>
> Or a device that effectively acts as such.
>
So what we did in the mid '90 when we where hit by pretty much the same 
was a bit simpler - any client which did not complete its headers within 
a a few seconds (or whatever a SLIP connection over a few k baud or so 
would need) was simply handed off by passing the file descriptor over a 
socket to a special single apache process. This one did a very single 
threaded async simple select() loop for all the laggards and would only 
pass it back to the main apache children once header reading was 
complete. This was later replaced by kernel accept filters.

Thanks,

Dw.