slowloris

Slowloris is a denial-of-service technique that targets web servers by exhausting their ability to handle new connections. It works by opening many connections to a target web server and then sending partial HTTP requests at a very slow rate. Instead of delivering a full request, it periodically sends additional header lines to keep those connections alive. Because the server must maintain an open connection for each request, the attack can consume all available worker processes or threads, denying service to legitimate clients.

The approach relies on servers that allocate resources per connection and wait for a complete request before freeing the connection. Slowloris uses relatively little bandwidth but a high number of concurrent connections, making it effective against servers that are not configured to time out or terminate slow clients quickly. It is most effective against traditional, thread-based servers rather than modern event-driven architectures.

Origin and history: Slowloris was created by Robert “RSnake” Hansen in 2009 as a demonstration of vulnerability in certain Apache configurations. Hansen released a PoC tool named Slowloris, highlighting how slow, partial requests could tie up server resources even with modest bandwidth.

Impact and mitigations: Slowloris can degrade or disable sites running susceptible configurations, particularly older or under-resourced servers. Modern servers with event-driven or properly hardened configurations are less vulnerable. Mitigations include using reverse proxies or firewalls to limit concurrent connections, enabling aggressive timeouts for incomplete requests, and tuning server settings to cap the number of partial connections. Implementations such as Apache’s mod_reqtimeout or similar mechanisms, and migrating to non-blocking, scalable server architectures, reduce the attack’s effectiveness.