Do you get flooded that frequently that this is an issue?
I've seen DOS, and various buffer overflows etc. in the real world, but
I've never seen this.
Unless its happening very often, I would have thought that some
monitoring and a 2am "Deny from ip" in your httpd.conf would be
enough ...
On Friday, June 8, 2001, at 01:50 am, Justin wrote:
> Does anyone see the value in a Throttle module that looked at
> the apache parent status block and rejected any request where
> another child was already busy servicing *that same IP* ?
> (note: the real IP is in the header in a backend setup so it
> is not possible to dig it out across children without
> creating another bit of shared memory or using the filesystem?).
>
> I'm still finding existing throttle modules do not pickup and
> block parallel or fast request streams fast enough .. ok there are
> no massive outages but 10 seconds of delay for everyone because
> all demons are busy servicing the same guy before we can conclude
> we're being flooded is not really great.. modperl driven forums
> (or PHP ones even) can be killed this way since there are so
> many links on one page, all active..
>
> thanks for any thoughts on this.
>
> -Justin
>
