You will probably be easy to find if anyone is looking at their logs at that point - although the DoS will be over by that point too.

It has the added benefit of allowing the server to come back at any time (once the program is killed), and not spamming the logs excessively.

Some servers may have a smaller tolerance for timeouts than others, but Slowloris can compensate for that by customizing the timeouts.

There is an added function to help you get started with finding the right sized timeouts as well.

As a side note, Slowloris does not consume a lot of resources so modern operating systems dont have a need to start shutting down sockets when they come under attack, which actually in turn makes Slowloris better than a typical flooder in certain circumstances.

For instance, if you know that the server has a timeout of 3000 seconds, but the the connection is fairly latent you may want to make the timeout window 2000 seconds and increase the TCP timeout to 5 seconds.

Most average Apache servers, for instance, tend to fall down between 400-600 sockets with a default configuration.

The smaller the timeout the faster you will consume all the available resources as other sockets that are in use become available - this would be solved by threading, but thats for a future revision.

The closer you can get to the exact number of sockets, the better, because that will reduce the amount of tries (and associated bandwidth) that Slowloris will make to be successful.

Slowloris has no way to identify if its successful or not though.

This way the logs that are created will go to a different virtual host log file, but only if they are kept separately.

Some caching servers may look at the request path part of the header, but by sending different requests each time you can abuse more resources.

The usefulness of this particular option has not been thoroughly tested.

They may be ways around this, but not in this version at this time.

Most likely most anti-DDoS and load balancers wont be thwarted by Slowloris, unless Slowloris is extremely distrubted, although only Netscalar has been tested.

Firstly, it does send out quite a few packets (although far far less than a typical GET request flooder).

So its not invisible if the traffic to the site is typically fairly low.

On higher traffic sites it will unlikely that it is noticed in the log files - although you may have trouble taking down a larger site with just one machine, depending on their architecture.

For some reason Slowloris works way better if run from a Nix box than from Windows.

I would guess that its probably to do with the fact that Windows limits the amount of open sockets you can have at once to a fairly small number.

If you find that you cant open any more ports than 130 or so on any server you test - youre probably running into this feature of modern operating systems.

Either way, this program seems to work best if run from FreeBSD.

Once you stop the DoS all the sockets will naturally close with a flurry of RST and FIN packets, at which time the web server or proxy server will write to its logs with a lot of 400 (Bad Request) errors.

So while the sockets remain open, you wont be in the logs, but once the sockets close youll have quite a few entries all lined up next to one another.

Slowloris Pl Download