3 ms·

Use Apache's LimitRequest* directives http://httpd.apache.org/docs/2.0/mod/core.html#limitrequestbody http://httpd.apache.org/docs/2.0/mod/core.html#limitreques

• eis 16y ago
  This suggestion is impractical as the attack works with even fairly small Content-Length. Say 10000 and sending 1 byte per second will limit you to 10kb uploads but still give each connection hours to run. Since most IO timeouts are fairly large you can even with a limit of 1000 bytes run a connection for hours until you hit this limit. The only solution is to limit connections per IP and maybe defining a minimum speed can help too.