Our mitigations below only apply to a limited number of deployed servers-ones that have relatively low volume and serve (usually) a small number of clients.Д«efore going further, it's important to figure out what device is actually affected by Slowloris. As an administrator, we have some ideas about how you can stop an attack. We know that Slowloris works, and SANS reports that some attackers are already using a similar tool to attack web servers. During the attack, Apache became unresponsive after a few seconds but recovered quickly once the attack was stopped. The web server being targeted is an Apache 2 (172.16.65.5) installation, a normal web browser is connecting from 172.16.65.4 and the Slowloris tool is running on 172.16.65.2. We've generated a few packet capture files that show Slowloris in action. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they'll allow. In this way webservers can be quickly tied up.

It continues to send subsequent headers at regular intervals to keep the sockets from closing. Slowloris holds connections open by sending partial HTTP requests. The Slowloris author's web page offers an excellent description of how the tool works: However, use caution if you implement any of these suggestions because they will likely have some unintended side effects. We have some suggestions about mitigation techniques and workarounds to protect your server.

Slowloris is a denial-of-service (DoS) tool that targets web servers.

Slowloris attack what is it