I am performing a test on some DoS attacks and how to detect them. I am currently testing the slowloris tool, but all the signature I have seen online, as very very few as they are,do not work even after modifying some parameters. Can someone point me to a site or an example of the snort detection rule for detecting slowloris attacks.

  • And the only answer to the latter correctly mentions that "it goes outside of the normal bounds of what Snort is designed to detect".
    – ximaera
    Feb 3, 2018 at 15:59
  • @Ximaera when deciding what is a duplicate, don't you look at the time stamp? This question was asked in April 2017. While the one you referenced was asked in November 2017... So which one is a duplicate of the other ?
    – cidi30bg
    Feb 3, 2018 at 17:05
  • But that question got a proper answer. I thought it's a good idea to reference it. Is it against the community rules here? Please advise.
    – ximaera
    Feb 3, 2018 at 17:30
  • 1
    Yeah @ximaera you are right. The question can be marked as duplicate if there exits another question with a good enough answer. See How should duplicate questions be handled?. I have gone ahead and accepted it as a duplicate.
    – cidi30bg
    Feb 3, 2018 at 17:41

1 Answer 1


slowloris don't finish web request header.

pcre:!"/\x0D\x0A\x0D\x0A$/H"; will detect web request not ending with 0D0A0D0A

Or you can also use /D that Match unnormalized HTTP request or HTTP response header.

But i'm not sure this would work.:) In fact, i think it is better to monitor changes in session volume than pattern matching, if you want to detect like slowloris.

  • 1
    Are you sure this would work? /H matches the normalized HTTP header but since slowloris does send the pieces of the HTTP header slowly there will be no HTTP header to normalize and thus I would expect that this rule does not get executed at all. Apart from that I would expected the normalized header to contain \r\n\r\n because it is normalized. Apr 9, 2017 at 6:05
  • yeah @SteffenUllrich these are some of the complicated things about detecting this attack. Anomaly based IDS's do actual detect this attack, but I wanted to see how effective an open source IDS like snort is to detecting slowloris and so far, non of the signatures I have seen works. I want to be sure I exhaust all expert opinion on this before I draw my conclusion that snort if ineffective on detecting slowloris
    – cidi30bg
    Apr 9, 2017 at 8:49
  • I edited my answer.
    – Mr.kang
    Apr 9, 2017 at 9:44

Not the answer you're looking for? Browse other questions tagged .