What is a Slowloris attack?
Slowloris is a low-bandwidth DDoS attack that takes down a web server by keeping many connections open as long as possible. Instead of flooding with traffic, it sends incomplete HTTP requests and keeps them alive by trickling partial headers periodically, occupying all of the server's available connections without ever completing them.
Why is it so effective with so few resources?
A single attacker on a modest machine can knock out a poorly configured Apache server because the attack doesn't rely on volume but on exhausting the pool of concurrent connections. Servers with low simultaneous-connection limits are especially vulnerable.
How to mitigate Slowloris?
Limit connections per IP, shorten timeouts for slow connections, use modules like mod_reqtimeout on Apache, and front the origin with a reverse proxy or load balancer (nginx, HAProxy) or an anti-DDoS service that drops incomplete connections before they reach it.
