I'm not aware that nginx has an option to "specify max connections before old ones start getting closed". The default behavior is that when max connections are

I'm not aware that nginx has an option to "specify max connections before old ones start getting closed". The default behavior is that when max connections are hit, it doesn't allow new connections[0]. Then with the default timeouts of 60 seconds for client_body_timeout and client_header_timeout, a connection can be held for at least 2 minutes[1][2]. Note that the body timeout is "The timeout is set only for a period between two successive read operations, not for the transmission of the whole request body.", so it's possible to arbitrarily extend the amount of time a single connection is open. Since these connections are long lived, and normal connections are generally short, the total number of connections gets dominated by the slow ones. If no other mitigations are put into place, then this can cause a server to hit ulimits/max_conns and keep legitimate requests blocked. This is known as the "Slowloris" attack[3], and is mentioned in the nginx DDoS mitigation blog post[4]. [0] - http://nginx.org/en/docs/http/ngx_http_upstream_module.html#server http://nginx.org/en/docs/http/ngx_http_upstream_module.html#... [1] - http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout http://nginx.org/en/docs/http/ngx_http_core_module.html#clie... [2] - http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout http://nginx.org/en/docs/http/ngx_http_core_module.html#clie... [3] - https://en.wikipedia.org/wiki/Slowloris_(computer_security) https://en.wikipedia.org/wiki/Slowloris_(computer_security) [4] - https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/ https://www.nginx.com/blog/mitigating-ddos-attacks-with-ngin...