I am investigating the vulnerability to Slowloris and I think I understand how and why this sort of attack works.

What I don't understand is why Lighttpd and NginX are not affected (according to the same article as linked above). What do they make so different?


Apache has a theory of 'Maximum Clients'

That is the number of simultaneous connections it can handle. I.E. if an apache server has a 'max clients' limit of 100, and each request takes 1 second to complete, it can handle a maximum of 100 requests per second.

An application like SlowLoris will flood a server with connections, in our example if SlowLoris sends 200 connections per second, and Apache can only handle 100 connections per second the connection queue will keep getting bigger and use up all the memory on the machine bringing it to a hault. This is similar to the way Anonymous' LOIC works.

NGINX and Lighttpd (Among others) don't have a maximum connections, they use worker threads instead so, theoretically, there's no limit to the number of connections they can handle.
If you monitor your Apache connections, you'll see that the majority of the active connections are 'Sending' or 'Receiving' data from the client. In NGINX/Lighttpd they just ignore these requests and let them run on in the background, not using up system resources, and it only has to process connections with something going on (Parsing responses, reading data from backend servers etc.)

I actually answered a similar question this afternoon, so the information in there might also be interesting to you Reducing Apache request queuing

  • Good and very detailed answer. +1
    – Oldskool
    Dec 29 '11 at 13:17
  • 8
    Minor correction: nginx does not use worker threads to achieve high number of connections. From nginx.org: "Nginx doesn't rely on threads to handle requests. Instead it uses a much more scalable event-driven (asynchronous) architecture"
    – Day
    Mar 26 '13 at 16:28
  • 2
    Although a possible side effect, the intent of Slowloris isn't to "use up all memory on the machine", but rather exhaust the maximum connection capacity denying subsequent connections from succeeding.
    – wulfgarpro
    May 14 '17 at 2:46
  • @Day Nginx does use worker threads to support it's asynchronous operation. A useful application architecture schematic is provided here: aosabook.org/en/nginx.html#fig.nginx.arch Feb 20 '19 at 23:40

Nginx is actually vulnerable to slowloris attack. Scarce resource is the maximum number of simultaneous worker connections. This number can be calculated as worker_connections * worker_processes and equals to 512 in default nginx configuration. So, it is quite easy to take down unprotected nginx with tools such as goloris.

  • goloris looks like the tool I need to make sure my implementation/setup works as expected! Apr 10 '17 at 4:52

valyala's comment should be accepted as the answer.

Most nginx servers use default configs and therefore vulnerable to slowloris attack. I have used slowloris to take down some of my friend's nginx websites using only my laptop and usually it took less than 5 minutes (my friends challenged me to do so).

As valyala stated, technically, nginx is not vulnerable to slowloris, but the default configs limit the max number of connections, so when the connections exceed that number, nginx drops the new request, which results in a denial of service.

The known ways to protect nginx from slowloris include limiting the number of connections from the same IP, and increasing the worker_connections config. The attack can still works, but it gets harder (maybe taking more than 5 minutes? :D)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.