Apache DOS and LTMs.

Hi,

 

 

Ben stated in this post (Click here) that he tested the client app against an ASM enabled virtual server and found ASM buffered the full request headers and payload before sending the request to the pool member.

 

 

Without ASM to buffer the request, I think it would depend on your VIP type and the type of attack. For an HTTP VIP, LTM by default buffers the HTTP headers before opening a server side connection. So if the malicious client was sending the headers very slowly, LTM should handle the attack.

 

 

I'm pretty sure that once the headers have been parsed, LTM sends data to the pool as it receives it. So you would potentially still be vulnerable to an attacker sending payloads very slowly. I suppose you could collect the payloads using HTTP::collect to handle the attack. LTM wouldn't suffer resource issues from collecting the request payload for the numbers of requests that have been described in the vulnerability. But collecting every request payload would add load to LTM and potentially add some latency to all client sessions.

 

 

Anyone else have ideas for this?

 

 

Aaron