Live data from Hacker News

Apache HTTP DoS tool released

isc.sans.org

31–32 of 32 posts

Re: Apache HTTP DoS tool released

#31
post #29
post #28

Earlier quoted context omitted.

Still, the overhead is large if it employs single byte confirmations. It turns symmetrical what could be an asymmetrical communication.

Sorry, wrong again. Stream byte acks are way more effective than packet ones. Tcp endpoint can receive several packets of data and then send just one very small ack packet (you only have to send the byte stream position after the last received packet). I'm not sure what you mean by "asymmetrical", but that's probably as asymmetrical as it gets. It's called "delayed ack" or something. Iirc, it's all described in rfc79…

What would be then the ideal way to fix Apache?

Re: Apache HTTP DoS tool released

#32
post #31
post #29

Earlier quoted context omitted.

Sorry, wrong again. Stream byte acks are way more effective than packet ones. Tcp endpoint can receive several packets of data and then send just one very small ack packet (you only have to send the byte stream position after the last received packet). I'm not sure what you mean by "asymmetrical", but that's probably as asymmetrical as it gets. It's called "delayed ack" or something. Iirc, it's all described in rfc79…

What would be then the ideal way to fix Apache?

Apache doesn't need "fixing" - this is the job of a firewall or IDS or some other such anti-DDoS software. That doesn't mean they couldn't incorporate some protocol patch or use asynchronous I/O or some other crap, but the reliance shouldn't be on Apache to block this. If you're running a website important enough to DDoS, you should have a heavy duty firewall and IDS and possibly reverse proxy in place as well.
Post reply on HN