How does limiting requests per connection help mitigate this attack?

Question

The `keepalive_requests` directive in web server configurations plays a crucial role in mitigating certain types of denial-of-service attacks, particularly those exploiting the HTTP/2 protocol's rapid reset functionality. This setting dictates the maximum number of requests that can be processed and served over a single, persistent HTTP connection. Once this predefined limit is reached, the server automatically terminates the connection.

Accepted Answer

By adhering to the recommended default value of 1000 requests for `keepalive_requests`, a significant defensive posture is established. In the context of an HTTP/2 Rapid Reset attack, which involves an attacker rapidly opening numerous streams and then immediately resetting them to overwhelm server resources, this limit becomes a critical control. An attacker attempting to exploit this vulnerability would find their effectiveness severely hampered. Instead of being able to sustain a high volume of malicious requests through a single connection, they would be forced to constantly re-establish new connections after each set of 1000 requests. This frequent need to reconnect makes the attack pattern far more conspicuous to network monitoring systems. The increased frequency of connection establishments and teardowns creates a readily identifiable signature, allowing for more straightforward detection and mitigation at the network perimeter. Consequently, this mechanism transforms a potentially stealthy and resource-draining attack into a more overt and manageable threat.

Reading history

Hide →

This history is cleared when the page is closed.

How does limiting requests per connection help mitigate this attack?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

3

0

0

Share with friends