httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Dirk-WIllem van Gulik <>
Subject Re: Mitigation Range header
Date Wed, 24 Aug 2011 12:59:11 GMT

On 24 Aug 2011, at 13:43, Florian Weimer wrote:

> * Dirk-WIllem van Gulik:
>> Hmm - when I remove mod_deflate (i.e. explicitly as it is the default
>> in all our installs) and test on a / entry which is a static file
>> which is large (100k)* - then I cannot get apache on its knees on a
>> freebsd machine - saturating the 1Gbit connection it has (Note: the
>> attack machines *are* getting saturated).  The moment i put in
>> mod_deflate, mod_external filter, etc - it is much easier to get
>> deplete enough resources to notice.
> Oh.  Have you checked memory usage on the server?

I had not - and you are right - quite high. I also tried it on a Ubuntu machine - and that
one dies right out of the gate - regardless as to wether deflate is on- or off.

So I guess this is somewhat OS specific - but indeed - not overly deflate specific. Deflate
just does something.

Ok - let me rewrite advisory draft !

View raw message