0

I am trying to implement a limit on the maximum number of concurrent connections a server can accept from a single IP address for DOS protection. I understand that HTTP/1.1 stipulates a maximum of two persistent connections per server (not clear whether it is based on server IP address or hostname) and that this requirement has not been followed by major browsers.

Browserscope website shows current browsers allowing 6-13 persistent connections per hostname and maximum connections of 10-60. Assuming that a maximum of 10 resources (HTML, images, css, javascripts) are served from two hostnames upon each page view, how should I derive this maximum concurrent connection limit so that HTTP request would not be dropped?

2
  • I wonder if this is more suited to serverfault.com?
    – MrWhite
    Nov 4, 2014 at 9:25
  • @w3d, not sure about that. I don't mind getting this migrated if there is no answer here. Nov 5, 2014 at 2:11

1 Answer 1

1

If you are using Apache webserver then you could use the mod_security module and SecAction directive to apply rate limiting to requests by IP address.

For example (includes configuration script):


Edited on 05-Nov-2014 following feedback:

  1. Before imposing any limits, monitor the actual useage over a period of a week or a month (depending on how your traffic patterns look in Google Analytics).

  2. Set an upper threshold limit, most people I speak to set it as your typical maximum usage plus between 5 and 25% but this really comes down to preference, and trial-and-error to see what works best for your website. I actually tend to set limits quite high such as at double or even sometimes more than double the normal usage since I know the server can handle it and the availability is the most important factor for me, but I trigger security alert messages when anything more than 5% happens so that I can closely watch or review logs and see if an attack is in progress. If you have the benefit of an enterprise-grade hardware firewall providing much greater protection against DoS/DDoS attacks then you may wish to configure your mod_security a little more generous with rate limits since most of the time attacks will be stopped before they reach your server, and pay closer attention to your hardware firewall logs and configuration.

  3. Regularly check logs to see if your threshold needs to be increased or reduced in order to strike the right balance between correct operation of your website and protecting it from attacks.

3
  • No, my question is not how to set the limit, but what limit to set. Nov 5, 2014 at 2:03
  • Ok I've edited the answer now to take this into account. Nov 5, 2014 at 10:08
  • Thanks for the edit. I am sorry, but it seems you have misunderstood my question. It has nothing to do with rate limiting HTTP request on the application server. My question is on maximum concurrent TCP connections on a single IP on the firewall itself. This has more to do with the effect of HTTP/1.1 pipelining and how a browser uses multiplexing to get a single request. And figuring out a reasonable maximum value for a single IP based on current browser behaviour. Nov 5, 2014 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.