topic Any defenses against slow HTTP Post DOS? in General Topics

Any defenses against slow HTTP Post DOS?

JKoss — Tue, 02 Nov 2010 13:42:25 GMT

http://www.darkreading.com/vulnerability_management/security/attacks/showArticle.jhtml?articleID=228000532&cid=nl_DR_daily_2010-11-02_html

Just wondering if there is anything our PA can do to protect from this kind of exploit?

Jim

Re: Any defenses against slow HTTP Post DOS?

migration — Tue, 02 Nov 2010 18:08:28 GMT

Hi Jim,

We are looking into this. I'll send an update when I have more information.

Thanks,
Sandeep

Re: Any defenses against slow HTTP Post DOS?

JKoss — Tue, 03 Sep 2013 15:48:10 GMT

Anything happening with this?

Re: Any defenses against slow HTTP Post DOS?

mikand — Tue, 03 Sep 2013 18:48:30 GMT

There are a few candidates in the threatvault:

This event indicates that someone want to exhaust the apache resources, as described by slowloris.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/40018

This event indicates a DOS attack against IIS server.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/40019

Among others.

There is also zone-protection but I cant find any good setting regarding "slow" connections in there (only stuff like number of concurrent sessions etc).

Edit: Hopefully these docs might be helpful:

https://live.paloaltonetworks.com/docs/DOC-1746

https://live.paloaltonetworks.com/docs/DOC-3767