2 ms·
No, currently we increment it when the HTTP request is parsed. (It counts HTTP requests, not packets/connections.) This was a quick and easy way to count; but I
by mholt 4y ago
No, currently we increment it when the HTTP request is parsed. (It counts HTTP requests, not packets/connections.) This was a quick and easy way to count; but I am very open to improving this! Feel free to submit a proposal or a PR.
Ref: https://github.com/caddyserver/caddy/blob/50748e19c34fc90882bbb268c95a2a0acb051752/modules/caddyhttp/server.go#L185-L186 https://github.com/caddyserver/caddy/blob/50748e19c34fc90882...
- CodesInChaos 4y agoIn that case, I don't think your metric works at all, since legitimate users will increase it, but attackers won't. During an attack it will either remain the same, or even go down as fewer legitimate users manage to connect. This attack is the QUIC equivalent of a SYN flood, which results in half-open connections, because the attacker is unable to complete the connection by responding to message the server sends. RequireAddressValidation corresponds enabling syn cookies. Unfortunately I don't use caddy myself, and don't have time to get involved deeper in improving this.
- mholt 4y agoI opened an issue with quic-go to get ideas for a better metric: https://github.com/lucas-clemente/quic-go/issues/3549 https://github.com/lucas-clemente/quic-go/issues/3549