Our firewall detected and blocked a Slow HTTP DoS the other day. There were only a few attempts in the log. It wasn't a full on attack (there would be more traffic). My question is...if I'm an attacker and I launch this type of attack, how would I know if it is potentially successful?

Is any traffic returned from the target during a Slow HTTP Dos?


  • What research have you done? Are you aware of code.google.com/p/slowhttptest
    – schroeder
    Jan 16, 2015 at 20:27
  • I'm all for research and your point is well taken. I do a lot of research but also have time constraints. Since it was a yes/no scenario, I figured I would just ask. Jan 16, 2015 at 20:56
  • Also thanks for the link. I know there are several vuln. scanners with this built in but was not aware of this code. Jan 16, 2015 at 20:57
  • could be slowloris as well, then you wouldnt see much in the logs of your webserver Jan 16, 2015 at 22:15
  • Didn't see you comment until I posted mine, lol. Good stuff. At least this confirms the train of thought. Jan 16, 2015 at 23:12

1 Answer 1


The ultimate success metric of a DoS attack is the loss of service. What is different about this type of DoS attack is that the control is in the attacker's hands: you limit how fast you read the server's response. So, yes, you get instant feedback that your attack is succeeding.

The answer to the question:

Is traffic returned?

is, of course, "Yes." Returning traffic is required.

Google's full write up on the attack is here

  • I'll share one of the sites I am using to learn about this. blogs.akamai.com/2013/09/slow-dos-on-the-rise.html I am understanding that there are 3 types: Slow HTTP Headers (Slowloris), Slow HTTP Post (RUDY), and Slow Read (what you linked to). So, I would focus my question on the first type, Slow HTTP Headers (Slowloris). I'm wondering if the web server responds with anything (Hey, I'm still waiting), or does it just wait for the completed response which never comes? Jan 16, 2015 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .