Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I didn't know this site existed before I posted this on StackOverflow, so please let me know if I'm breaking some forum etiquette or something.

In order to protect ourselves from a slowloris-type attack, we have configured the mod_reqtimeout module on our Apache 2.2.17 installation (running on Solaris, MPM compiled). The mod_reqtimeout is configured as follows:

RequestReadTimeout header=10-20,MinRate=500 body=10-20,MinRate=500

We are testing using the OWASP http_dos_cli tool and are still able to make the site unreachable in a couple of seconds. In the logs we see that the request is truncated after 20 seconds and is then processed. Since the URL is referring to an actual resource, a 200 status code is returned. This prevents our mod_security rule set to detect 408 status codes, gather IP-based statistics and block further requests from this IP.

Any idea on why mod_reqtimeout is truncating the request instead of dropping it and returning a 408?

share|improve this question
Actually, Apache is sending a 302 Redirect because of a RedirectMatch directive in the httpd-vhosts.conf file. Still, that request should time out and return a 408, not a 302 – Spiff Apr 26 '11 at 15:09
up vote 0 down vote accepted

I have opened a bug report and received confirmation that issues in HTTPD Core are causing the following problems:

  • Apache doesn't always return a 408 when a request time out is detected (various cases)
  • Apache doesn't handle a request time out properly when the URL corresponds to a RedirectMatch directive

More details here:

Hope that helps someone eventually.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.