Dealing with Layer 7 DDoS attacks (RUDY, Slowloris, etc)

[Maxim Dounin]

Hello!

On Mon, Jul 25, 2011 at 01:09:50PM -0400, Mel Brands wrote:

> I am curious as to how nginx deals with DDoS attacks that attack
> through app layer, layer 7. I managed to find this page:
> 
> http://blog.rayfoo.info/2009/10/testing-slowloris-against-nginx
> 
> which claims that nginx is susceptible to the attack. Since this is
> from 2009, has anything changed?

Not really.  As link suggests nginx handles this type of attacks 
well as is.  There is a room for improvement though.

> Also, has anyone tested nginx vs R-U-DEAD-YET (RUDY)? I haven't found
> any tests online...
> 
> http://code.google.com/p/r-u-dead-yet/

This type of attacks could be easily mitigated with limit_zone 
module[1].

[1] http://wiki.nginx.org/HttpLimitZoneModule

Maxim Dounin