What is a Slow Read DDoS Attack?
A slow read DDoS attack involves an attacker sending an appropriate HTTP request to a server, but then reading the response at a very slow speed, if at all. By reading the response slowly – sometimes as slow as one byte at a time – the attacker prevents the server from incurring an idle connection timeout.
Since the attacker sends a Zero window to the server, the server assumes the client is actually reading the data and therefore keeps the connection open. This has the cumulative effect of consuming server resources, thus preventing legitimate requests from going through.
A Slow Read DDoS attack is characterized by a very low number for the TCP Receive Window size, while at the same time draining the attacker’s TCP receive buffer slowly. This in turn creates a condition where the data flow rate is extremely low.
What Are the Signs of a Slow Read DDoS Attack?
Similar to a Slow Post DDoS attack, a Slow Read DDoS attack will result in the connection staying open for a long time. If the attacker establishes multiple connections, for example by using a DDoS Botnet, he/she will be able to fill up the connection tables, resulting in legitimate users not being able to access the services. The indicators will be that the server has large amount of connections, but very little traffic is sent or received.
Why Are Slow Read DDoS Attacks Dangerous?
Because Slow Read and other application layer DDoS attacks don’t require extensive bandwidth, unlike brute-force DDoS attacks, they can be difficult to differentiate from normal traffic. Since these DDoS attacks don’t require a great deal of resources, they can be instigated from a single computer, making them very easy to launch and difficult to mitigate.
Mitigation Tips For Slow Read DDoS Attacks
Since traditional rate detection techniques won’t stop a Slow Read DDoS attack, one mitigation method is to upgrade server capacity. Logically, with more connections available on the server, an attack is less likely to overwhelm that server. Unfortunately, in many cases, the attacker will simply scale up the attack to attempt to overwhelm the increased server capacity.
Another mitigation approach is reverse-proxy-based protection, which will intercept Slow Read DDoS attacks prior to reaching the server. While no mitigation method will completely eliminate the threat of Slow Read attacks, the following are additional steps that can be taken:
- Set an absolute connection timeout based on the median of connections from legitimate clients.
- Establish a minimum incoming data rate, then drop any connections that are slower than that rate.
- Consider adding further DDoS mitigation measures such as event-driven software load balancers, hardware load balancers to perform delayed binding, and intrusion detection/prevention systems to drop connections that match suspect behavior patterns gleaned from log files.
How can NETSCOUT help?
NETSCOUT's Arbor DDoS solution has been protecting the world's largest and most demanding networks from DDoS attacks for more than a decade. We strongly believe that the best way to protect your resources from modern DDoS attacks is through a multi-layer deployment of purpose-built DDoS mitigation solutions.
Only with a tightly integrated, multi-layer defense can you adequately protect your organization from the full spectrum of DDoS attacks.
Arbor SP/Threat Mitigation System
NETSCOUT customers enjoy a considerable competitive advantage by getting both a micro view of their own network, via our products, combined with a macro view of global Internet traffic, via NETSCOUT Omnis Threat Horizon, an interface to our ATLAS threat intelligence and a DDoS Attack Map visualization.
Related Resources
Application Layer Attack
Looking for more information about application layer DDoS attacks? You’ve come to the right place. Get the information you need to keep your network safe.
Digital Attack Map
Click here to view a live global map of DDoS attack activity through NETSCOUT Omnis Threat Horizon.
ASERT Blog
Read the latest news and insights from NETSCOUT’s world-class security researchers and analysts.