Using HTTP POST for denial of service

Posted Dec 2, 2010 18:29 UTC (Thu) by mcmanus (guest, #4569)
Parent article: Using HTTP POST for denial of service

I did some work a while back on using pessimistically constructed SACKs to DoS any webserver that needed to serve up largeish responses. It uses bog standard simple HTTP requests. In addition to tie-ing up fixed server resources for a long time you can severely tax the server CPU over the same period.

http://www.ibm.com/developerworks/linux/library/l-tcp-sac...

I haven't been following SACK all that closely since, but I'm not aware of anything that would have changed it. But there are a good dozen active DoS vectors at any given time, so the whole category is a hard one to get too worked up about.

Using HTTP POST for denial of service

Posted Dec 3, 2010 20:31 UTC (Fri) by bradfitz (subscriber, #4378) [Link] (1 responses)

This is news? When I wrote Perlbal (http://www.danga.com/perlbal/) I explicitly "defended" against this, not because of attacks but because I didn't want backends wasting time & memory reading requests from slow clients (where slow == not 1 Gbps).

Perlbal can buffer POSTs in memory up to a given time/space threshold, and then spill to disk until received, and the blast it away at the backend once fully received.

So just put Perlbal in front of it. (It's in front of LiveJournal, TypePad, etc...)

Using HTTP POST for denial of service

Posted Dec 3, 2010 20:32 UTC (Fri) by bradfitz (subscriber, #4378) [Link]

Whoops, I fail at replying on LWN, it seems. Also at reading previous replies. Double fail.