mod_limitipconn doesn't work, because there is no completed request for a connection. There was a handshake and part of the request is sent, but does Apache see

mod_limitipconn doesn't work, because there is no completed request for a connection. There was a handshake and part of the request is sent, but does Apache see that as a connection? I think not. You're confusing this with a SYN flood, which works at the IP level, not the userspace level, and for which a connection limit in user space would indeed be ineffective. In this attack, data is already transmitted, but it is incomplete, so the server can't act upon the request, and apache does hold that connection. More info/discussion to the attack here: http://news.ycombinator.com/item?id=665741 http://news.ycombinator.com/item?id=665741