Home/ Questions/Q 8554261
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T14:50:29+00:00

What is a good tool that will help me find out if my server

  • 0

What is a good tool that will help me find out if my server is being attacked by slowloris?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    One simple method is to use netstat to check the number of open connections:

    $ netstat -nt
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 127.0.0.1:5432          127.0.0.1:39521         ESTABLISHED
tcp        0      0 127.0.0.1:5432          127.0.0.1:39906         ESTABLISHED
…

    If that list ever gets huge, you’re likely being hit by slowloris:

    …
Proto Recv-Q Send-Q Local Address         Foreign Address       State      
tcp      232      0 67.230.168.1:80       96.125.213.1:56837    ESTABLISHED
tcp      232      0 67.230.168.1:80       96.125.213.1:56831    ESTABLISHED
tcp      232      0 67.230.168.1:80       96.125.213.1:56752    ESTABLISHED
… many more …
    • 0