Slowloris & TCP SYN Flood DDoS Rate Calculator & Mitigation Builder (2026)

Volumetric DDoS attacks flood server bandwidth with massive gigabits of UDP/ICMP traffic. Slowloris is a low-bandwidth Layer 7 attack that opens hundreds of legitimate TCP connections, sending incomplete HTTP headers at slow intervals (e.g., every 15 seconds) to tie up all available worker threads with almost zero bandwidth.

A SYN flood exploits the TCP 3-way handshake by sending a flood of TCP SYN packets with spoofed source IPs without sending the final ACK. The server allocates kernel memory in its SYN backlog queue for each half-open state until legitimate clients are refused.

SYN Cookies allow Linux to avoid allocating memory for half-open connections. Instead, the server encodes connection state into the initial sequence number of the SYN-ACK packet and only allocates memory when a valid ACK arrives.

Nginx mitigates Slowloris by setting aggressive client_header_timeout and client_body_timeout directives (e.g. 10s), along with limit_conn_zone to restrict concurrent connections per IP.

SYN-proxy intercepts incoming SYN packets at the firewall level, completes the handshake with the client on behalf of the backend server, and only connects to the backend application once the full 3-way handshake is verified.