Scheduling jitter on a loaded server is going to make this attack much harder for sure. If you have a sufficiently good position against the server, you can jus

Scheduling jitter on a loaded server is going to make this attack much harder for sure. If you have a sufficiently good position against the server, you can just delay all other traffic going into it but, except for that, such jitter may well make the number of connections needed very high - such that it takes weeks or months to pull off. That might well be infeasible, yes. However, many large sites have several serving locations, testing servers etc. If a location is drained of frontend traffic, or the testing server isn't being used all the time then you may well be able to find an idle server. After all, the attacker gets to choose where the traffic goes.