4 ms·
Yep, and this is why evented io is pretty much mandatory for a modern webserver (like nginx). If you need Apache you can always proxy nginx in front of it.
by andrewvc 16y ago
Yep, and this is why evented io is pretty much mandatory for a modern webserver (like nginx). If you need Apache you can always proxy nginx in front of it.
- tedunangst 16y agofile descriptors aren't free, even for evented webservers. you've only moved the limit higher, not removed it.
- tptacek 16y agoThis is true but not really responsive to the parent comment's point; the nginx architecture is better suited to handling this kind of attack; contexts are much more expensive than file descriptors. File descriptors are themselves an artificial construct that can be coded around. In the unlikely event that this attack ever became super relevant, a relatively simple kernel module could drastically amp up the number of connections a host could absorb --- although a RED queue would probably keep you from having to go even that far.
- tedunangst 16y agoI'm not sure what you mean by context. Clearly nginx also has some context, such as the data read so far, associated with each handle. I guess you mean thread stack?
- tptacek 16y agoApache has an entire execution context associated with it (either a thread or a process).