@ Looking at the attack you have just a bunch of open connections, i.e likely a Layer 4 connection flood. Event based web servers are great for resolving Layer 4 floods against a HTTP Server (Layer 7 server). However you still need the ram (nginx 4-32kb per connection) to track the connection, so keep that in mind.
Layer 7 attacks can be quite complex to mitigate compared to Layer 4 attacks. For example. here is a non-exhaustive list of common types:
Layer 7 attacks can be quite complex to mitigate compared to Layer 4 attacks. For example. here is a non-exhaustive list of common types:
- HTTP Reflection: a Joomla / Wordpress Reflection (large numbers of compromised / insecure software) attack
- Flooding: HTTP (GET|POST|HEAD|OPTION) flooding
- Dynamic: Dynamic attack (i.e with cache busting ?=/d+ or crawl based urls)
- Resource Inclusion: Iframe, AJAX or Image resource inclusion attack
- Semantic: Range resource exhaustion, long form names, large numbers of PHP arrays etc.
- Slow Client: Slow POST, Slow client header. Attack types like Slowloris etc.
Last edited by a moderator:
We'll be 24/5 and working on getting the weekends fully covered as well.