We are running a network analyzer . And we log info which are in the HTTP request headers and HTTP response code.
Because in keep alive connection request may come without responses. I push requests to a queue and wait until response. Because my customers requires also response code I have to wait for response header.
I have a length control before I push more request to my queue, if there 10000 request waiting for response from the client I won't push request header info anymore.
Our product has been running for years on serious network traffics(10g/sec). Now in one of the customer site I saw alarms about maximum number of request in the queue .
I am wondering if that could be a attack or something unnormal? Is there any known case about like http request spoofing?