We have a Java app I'm serving from Apache 2.2 + mod_proxy_ajp + Tomcat 6 that is a REST API and end users tend to like to totally slam it as fast as they can. I'd like to be able to throttle the hits per second, ideally by user/IP, to it. Like how Amazon, Twitter, etc. rate limits hits to their APIs.

  1. Preferably in Apache or Tomcat itself, but in the OS (Fedora) is ok, although I don't want to affect the other Tomcat apps on the same box (so just doing iptables on port 80 isn't the best solution)
  2. I don't want to limit bandwidth, this app doesn't produce more than 1k of output per hit, just the raw number of hits to the app to protect Tomcat from being overwhelmed
  3. I'm running on Amazon AWS EC2 so no multiple IPs per box or other complicated networking solutions
  4. I'm open to solutions I can tell the developers to put into their code, but would like it to be something I can control from an admin point of view (like I can change log levels using their log4j config files).

Seems like all the Apache modules to do stuff like that are all abandoned and not Apache 2.2 compatible. Ideas?


Take a look at mod_limitipconn2, it might be what you're after:


This would allow you to limit it to one connection per IP, effectively turning the user's browser into a synchronous connection instead of it opening the usual 4-6 (thinking Firefox) by default.

| improve this answer | |
  • That would definitely help some. It'd be nice if I could throttle beyond that, but I think that at least prevents parallel flooding, thanks. – Ernest Mueller Sep 7 '10 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.