Recently a script called "slowloris" has gained attention. The basic concept of what slowloris does is not a new attack but given the recent attention I have seen a small increase in attacks against some of our Apache websites.
At the moment there does not appear to be any 100% defence against this.
The best solution we have determined (so far) is to increase MaxClients.
This of course does nothing more than increase the requirements for the attacker's computer and does not actually protect the server 100%.
One other report indicates that using a reverse proxy (such as Perlbal) in front of the Apache server can help prevent the attack.
Using mod_evasive to limit the number of connections from one host and use mod_security to deny requests that look like they were issued by slowloris seem to be the best defence so far.
Has anyone on ServerFault been experiencing attacks such as this? If so, what measures did you implement to defend/prevent it?
NOTE: This question is for Apache servers as it is my understanding that Windows IIS servers are not affected.