| |||||||||||||
Apache range request denial of serviceApache range request denial of servicePosted Sep 11, 2011 6:14 UTC (Sun) by dlang (✭ supporter ✭, #313)In reply to: Apache range request denial of service by slashdot Parent article: Apache range request denial of service
if they are done as separate requests an external firewall or load balancer will see all the individual requests and can throttle them.
also, as separate requests, each one will get logged so it will be obvious that you have lots of requests from one source. as multiple overlapping ranges, you won't get any log message until everything is complete.
I see this as primarily a HTTP protocol bug that apache ends up being especially inefficient at handling, but to a large degree all other servers should be vulnerable as well.
but the idea that you can DOS apache is far from new, this is just one additional method of doing so.
(Log in to post comments)
|
|||||||||||||