Slow Loris DoS Attack - Revision history

LLedl: /* Appendix */

2026-03-09T05:01:38Z

Appendix

← Older revision		Revision as of 05:01, 9 March 2026
Line 172:		Line 172:
	All parameters are kept constant atthe HAproxy in Scenario 3.		All parameters are kept constant atthe HAproxy in Scenario 3.

	== Appendix ==		== Appendix Practical Slow Loris attack scenarios ==

LLedl: /* Appendix */

2026-03-09T04:58:38Z

Appendix

← Older revision		Revision as of 04:58, 9 March 2026
Line 173:		Line 173:

	== Appendix ==		== Appendix ==


	=== Bash script used for monitoring ===		=== Bash script used for monitoring ===

LLedl: /* Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy */

2026-03-09T04:57:09Z

Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy

← Older revision		Revision as of 04:57, 9 March 2026
Line 171:		Line 171:
	[[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]		[[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]
	All parameters are kept constant atthe HAproxy in Scenario 3.		All parameters are kept constant atthe HAproxy in Scenario 3.

			== Appendix ==

	=== Bash script used for monitoring ===		=== Bash script used for monitoring ===

LLedl: /* Bash script used for monitoring */

2026-03-09T04:54:56Z

Bash script used for monitoring

@@ Line 172: / Line 172: @@
 All parameters are kept constant atthe HAproxy in Scenario 3.
-=== Bash script used for monitoring===
+=== Bash script used for monitoring ===
 <pre>
@@ Line 209: / Line 209: @@
      sleep $INTERVAL
 done
 </p>

LLedl: /* Scenario 2 Slow Loris attack against apache webserver with the the "reqtimeout_module" enabled */

2026-03-09T04:50:53Z

Scenario 2 Slow Loris attack against apache webserver with the the "reqtimeout_module" enabled

← Older revision		Revision as of 04:50, 9 March 2026
Line 157:		Line 157:


	A clear repeating pattern is visible. A finite number of worker threads are bound one after another until the default rule takes effect and prevents a large number of worker threads from being blocked any longer, resulting in the number of bound worker threads stabilising after 20 seconds.		A clear repeating pattern is visible. A finite number of worker threads are bound one after another until the default rule takes effect and prevents a large number of worker threads from being blocked any longer, resulting in the number of bound worker threads stabilising after 20 seconds. After a further 20 seconds, the second drop of the busy workers releases the remaining bound threads. This starts the cycle again.
	[[File:ApacheReqtimeoutEnabledChart.png]]		[[File:ApacheReqtimeoutEnabledChart.png]]
	The figure reflects the default settings of the reqtimeout module in the form of bound threads (red), unbound threads (green) and how many of the bound threads were in the Reading Request status (blue) at that point in time. Constantly being in the Reading Request phase is an indicator of a Slow Loris attack.		The figure reflects the default settings of the reqtimeout module in the form of bound threads (red), unbound threads (green) and how many of the bound threads were in the Reading Request status (blue) at that point in time. Constantly being in the Reading Request phase is an indicator of a Slow Loris attack.

LLedl: /* Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy */

2026-03-09T04:46:07Z

Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy

@@ Line 171: / Line 171: @@
 [[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]
 All parameters are kept constant atthe HAproxy in Scenario 3.
 == References ==

LLedl: /* Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy */

2026-03-09T04:40:33Z

Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy

← Older revision		Revision as of 04:40, 9 March 2026
Line 167:		Line 167:


			The Haproxy archives the best results from all three scenarios.

	[[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]		[[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]

LLedl: /* Scenario 2 Slow Loris attack against apache webserver with the the "reqtimeout_module" enabled */

2026-03-09T04:36:02Z

Scenario 2 Slow Loris attack against apache webserver with the the "reqtimeout_module" enabled

← Older revision		Revision as of 04:36, 9 March 2026
Line 159:		Line 159:
	A clear repeating pattern is visible. A finite number of worker threads are bound one after another until the default rule takes effect and prevents a large number of worker threads from being blocked any longer, resulting in the number of bound worker threads stabilising after 20 seconds.		A clear repeating pattern is visible. A finite number of worker threads are bound one after another until the default rule takes effect and prevents a large number of worker threads from being blocked any longer, resulting in the number of bound worker threads stabilising after 20 seconds.
	[[File:ApacheReqtimeoutEnabledChart.png]]		[[File:ApacheReqtimeoutEnabledChart.png]]
	The figure reflects the default settings of the reqtimeout module in the form of bound threads (red), unbound threads (green) and how many of the bound threads were in the Reading Request status (blue) at that point in time.		The figure reflects the default settings of the reqtimeout module in the form of bound threads (red), unbound threads (green) and how many of the bound threads were in the Reading Request status (blue) at that point in time. Constantly being in the Reading Request phase is an indicator of a Slow Loris attack.

	=== Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy===		=== Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy===

LLedl: /* Practical slow loris attack scenarios */

2026-03-09T04:32:42Z

Practical slow loris attack scenarios

← Older revision		Revision as of 04:32, 9 March 2026
Line 116:		Line 116:
	Some practical slowloris attack scenarios against the Apache web server are presented in the following section. All the attack scenarios were carried out on two virtual machines running Ubuntu 22.04.4 LTS. Each VM had access to 4 GiB of RAM and a dual-core processor. A level 2 hypervisor, VMware® Workstation 17 Pro version 17.5.2, was used. Apache version 2.4.52 was used as a web server.		Some practical slowloris attack scenarios against the Apache web server are presented in the following section. All the attack scenarios were carried out on two virtual machines running Ubuntu 22.04.4 LTS. Each VM had access to 4 GiB of RAM and a dual-core processor. A level 2 hypervisor, VMware® Workstation 17 Pro version 17.5.2, was used. Apache version 2.4.52 was used as a web server.

	The following scenarios illustrate the effects of a Slow Loris attack on the Apache web server when it is running with the "mpm_prefork" module. The Apache web server using the "mpm_prefork" module is used for this analysis because it most clearly shows the effects of the Slow Loris attack. However, it should be noted that there are other modules for the Apache web server that are far less affected by the Slow Loris attack. The server status panel integrated into the Apache web server provides information that can be used to visualise changes in the availability and status of the limited resource 'working threads' at the end of Sections 2 and 3~~. For these visualisations, all traffic is assumed to be malicious~~. The several scenarios should help people with an interest in the subject to deepen their understanding of the Slow Loris attack.		The following scenarios illustrate the effects of a Slow Loris attack on the Apache web server when it is running with the "mpm_prefork" module. The Apache web server using the "mpm_prefork" module is used for this analysis because it most clearly shows the effects of the Slow Loris attack. However, it should be noted that there are other modules for the Apache web server that are far less affected by the Slow Loris attack. The server status panel integrated into the Apache web server provides information that can be used to visualise changes in the availability and status of the limited resource 'working threads' at the end of Sections 2 and 3. The several scenarios should help people with an interest in the subject to deepen their understanding of the Slow Loris attack.

LLedl: /* Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy */

2026-03-09T04:27:32Z

Scenario 3 Slow Loris attack against apache webserver with the the "reqtimeout_module" disabled, protected by HAProxy

← Older revision		Revision as of 04:27, 9 March 2026
Line 164:		Line 164:
	[[File:Scenario3.png\|500px]]		[[File:Scenario3.png\|500px]]

	The Figure representing Scenario 3 shows an Apache web server using the prefork module. The reqtimeout_module is deactivated, but HAProxy, which runs on the same machine, defends the web server against Slow Loris attacks. ~~All parameters are kept constant.~~		The Figure representing Scenario 3 shows an Apache web server using the prefork module. The reqtimeout_module is deactivated, but HAProxy, which runs on the same machine, defends the web server against Slow Loris attacks.




	[[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]		[[File:Apache&ReqtimeoutDisabled&HAProxyEnabled.png]]
			All parameters are kept constant atthe HAproxy in Scenario 3.

	== References ==		== References ==