Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i thought my server was safe with http-guardian but apparently not. Some smart arse keeps hitting my server with 'Keep-Dead' and causing it to crash.

I've looked through the logs but can't see anyway to tell the requests apart from a regular visitor who's browser is quickly loading all the components on a busy page.

Any advice would be appreciated.

share|improve this question

migrated from Mar 22 '11 at 0:16

This question came from our site for professional and enthusiast programmers.

Oh sorry, I should have said. The only info I've managed to find on Keep-Dead so far is on . But it contains no hints about how to block it! – Stevie Mar 21 '11 at 18:02
Pedantic Note: You're never safe. If someone wants to bad enough, they always will be able to get in. Period. – ircmaxell Mar 21 '11 at 18:04

Disable HTTP keep-alive, or install a server that isn't effected by this as a proxy in front of Apache. Nginx would be a good choice here.

This attack appears to be similar to the Slowloris attack, in that it exploits a specific feature of Apache. It's pretty trivial to defend against.

Note: If you install nginx, disable keep-alive on apache, and keep it enabled on nginx.

share|improve this answer
Isn't keep alive a pretty important feature? I could understand temporarily disabling it, but permanently? – TheLQ May 10 '11 at 22:54
It may result in slightly longer load times, but it's not like it's going to result in your site failing to load for people. Installing nginx in front is a far better solution. – devicenull May 11 '11 at 4:29

Keep-Dead works by sending HEAD requests while keeping the TCP connection alive (Keep-Alive, thus the name of the script). That is probably quite distinct from legit requests to your webserver that would probably mostly be POST/GET. Ask your IDS/IPS to detect numerous HEAD requests within a short timespan and do what's appropriate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.