[Page Previous 1, 2]

Topic: Request: Already compiled mod_antiloris.so

[2]

Topic: Request: Already compiled mod_antiloris.so

[puertoblack2003]

what would be the best ipreadlimit number to set it too?

[glsmith]

I've left mine at it's default of 5.

Keep an eye on your error log however, if you see a lot of messages in it like the ones shown on the prior page, then you may need to move that number up.

[puertoblack2003]

[glsmith]

Digging up an old one.

Flatcircle, have you played with the new mod_reqtimeout that came with 2.2.15? It was made with slowloris in mind.

[maskego]

Can use "Mod_LimitIPConn" to stop this attack?
or any good idea to stop it?

To shorten the "timeouts" is key to solve this exploit?

regards.

[glsmith]

@maskego

> Can use "Mod_LimitIPConn" to stop this attack?
No

> To shorten the "timeouts" is key to solve this exploit?
Not really, it helps but you can only set the timeout so low before it affects the server's performance, and that is still not low enough to stop Slowloris.

>or any good idea to stop it?
mod_antiloris works against it and is simple to use.

mod_reqtimeout is supposed to deal with it, is a little more complex to set up but I find the theory behind it quite unique and ingenious. It doesn't keep track of IPs and how many connections the IP is using, but deals with each connection individually.

It's still using timeouts however (be it a dynamic timeout) which I think on any version of Windows that has the connection limit, mod_reqtimeout may not help as much, that's just my guess though.

[maskego]

I get it.
regards.

[maskego]

If the IPReadLimit number set too high,what issue will occur?does mod_Antiloris will not against slowloris attack?or other?

What type of log will generate while web suffer slowloris attacking?

regards

[glsmith]

I would think that if you had a limited number of connections, and you set it at or above that number, if your attacked, your server will become unreachable during the attack.

you can see the error log listing on page 1 of this thread about 2/3 of the way down the page. Click "Previous" under the thread title on top left of this page.

[maskego]

Actually,I check logs and find some ones who are rejected by this mod.I don't know how many connections is the right web browsers used numbers.

How to define the numbers of various web browsers connect?

best regards.

[glsmith]

Nor do I.

I only know that the only thing I see this on is files being downloaded by aggressive download managers. I have no problem with this as it keeps them from opening a gazillion connections, they still get the file and just as fast.

I've never seen it block actual content.

[maskego]

Do you mean,this module will limit the number of connection behind the web?But,the users will browse the web content via limited number of connection?

regards.