Skip Montanaro wrote:
>> You might be able to slow them down. Depending what
sort of control
>> you have over the HTTP bits stuffed on the wire,
when you encounter
>> requests for such pages, you can have the thread serving the >> connection slow its responses to a crawl, issue "100
Continue"
>> responses, etc.
Chris> Isn't this the same as a DOS attack on yur own server, though?
To avoid this problem you could cap the number of
"sluggish" responses
at some figure, after which you simply fall back to regular 404 responses.
You know, I am not so sure you ought to go slowing down your responses to these attacks. It won't really affect the sending sites, since they are done automatically and there is no one to get bored or irritated by the slowness. But it will slow down your own machine by tying up one or more threads. Why not just send a 403 response ("Forbidden") and walk through the attacking sequence as fast as possible and be done with it? As I recall from some of my testing on these attacks, if you give any response that seems like a return, they go through their entire repertoire. A 403 still elicits part of the standard bag of tricks, but less of it, IIRC. 403 was, I thought at the time, the best response in terms of minimizing the number of requests in one of these attack sequences. Cheers, Tom P