This question already has an answer here:

I'm under a DDOS attack right now, and the attacker has his zombies sending POST requests to one of my pages. At first, nginx replies in only a few seconds, but after a while it starts building up; nginx is taking 10 minutes to finish the responses to these requests! But why? I can't understand why. I can't even figure out why I can't stop it.

I've got these set:

    client_header_timeout 5;
    client_body_timeout 5;
    keepalive_timeout 5 30;
    send_timeout 5;

So should it not be timing out after 5 seconds? Why does it continue to 600 seconds or more? Is there a way I can figure out what type of attack this is? Slow header? Slow POST? How can I detect what this attack is and how can I stop it?

It should also be noted that the connections are passing through a load balancer and a Squid Cache reverse proxy, so the only way I can read the clients' true IP is through specific HTTP headers

marked as duplicate by Tom O'Connor Aug 25 '13 at 22:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


It will be hard to figure it out like this; I would suggest a full packet tcpdump of one of DDoS sources and then analyze what he is doing in wireshark or some other tool for inspecting captured data.

Not the answer you're looking for? Browse other questions tagged or ask your own question.