So basically, if the server is let's say Apache or any other thread based server, so if I create multiple sockets on my machine and request the server until all of its threads get exhausted and try to keep the connection open, then is it a DDoS attack?

I know this is how slowloris works, but I want to know if this type of attack comes under a DDoS attack, because we have not created multiple IP's to send request. We are using just a single IP.

1 Answer 1


DDoS means Distributed Denial of Service. Your attack is not distributed over multiple client hosts, so it is not a distributed DoS. If it makes the server unavailable it is still a (non-distributed) Denial of Service attack.

Note that the "distributed" part of DDoS really means using many multiple client systems, not just different IP addresses (a single machine might have multiple IP). This way it combines the resources of many systems to a more powerful attack, which a single client system by its own could not do. In addition it often means a variety of sources of the attack, which makes it harder to defend against.

  • But can you explain how multiple hosts will bring a difference in the picture as they will also send request to the server and try to exhaust all the threads which is replicated by creating multiple sockets on a single machine. Dec 5, 2022 at 19:56
  • Adding on to the edit, slowloris is a ddos attack on the application layer of the OSI model. It does not use much bandwidth but is a powerful attack. I understand your point sir that there is no distributed network of systems here but I am trying to look at the scene going on with the server. If the threads on the server gets exhausted by multiple sockets (as in slowloris) or multiple systems combined as in real DDoS it will be the same thing happening on the server end. Dec 5, 2022 at 20:03
  • 1
    @EshuManohare: Some kind of resource exhaustion (no matter if bandwidth, CPU, sockets, ...) is common for all DoS and not special for DDoS. What makes DDoS special is the distributed part, i.e. combining power and combing many sources. Dec 5, 2022 at 20:50
  • This research journal clearly mentions slowloris as a DDoS attack which works on the same principle I have discussed here. Please check section 3.4. researchgate.net/publication/… Dec 5, 2022 at 21:05
  • @EshuManohare: to cite from section 2 in the paper you mention: "The source of DDoS is distributed as it is derived from various locations,". Note that the classification of a tool as a "DDoS tool" does not make any use of the tool magically DDoS, it only described what the typical use case is. Dec 5, 2022 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .