Re: Hash Table Collisions (n.runs-SA-2011.004)

[Petite Abeille <petite.abeille@...>]

On Jan 5, 2012, at 9:44 PM, David Favro wrote:

> On 01/03/2012 06:28 PM, Petite Abeille wrote:
>> In the meantime, feel free  to break Nanoki, which sports an HTTP server implemented in pure Lua.
> 
> I had a rather amateurish go at Mr. Abeille's generous offer to DoS his
> server using the method he described (colliding HTTP headers), and
> tcpserver+Nanoki seemed to serve it well.  36k colliding headers (1.2MB)
> does fine to seize up the processing of the request, but after 60s it's
> canceled as expected (the same request, with non-colliding headers, only
> takes 6s total round-trip).
> 
> I never degraded the response time for legitimate requests below a few
> seconds, perhaps because my ISP limits my upstream bandwidth or perhaps due
> to some other problem in my attempts to get many simultaneous requests going.

Excellent. Thanks for giving it a go :)