View source for WAF 343434

'''Rule ID''' 

343434

'''Status'''

Active rule currently published.

'''Alert Message'''  

Atomicorp.com WAF Rules: Client Connection dropped by Apache due to slow connection, possible Slowaris attack

'''Description'''  

This rule detects when apache has generated a 408 error, and has dropped the connection.  The rule does not block anything (because apache has already taken action), it just reports when this occurs.  

Disabling this rule has no effect on apache dropping the connection.

'''False Positives'''

No false positive with this rule can occur.  The rule just detects 408 errors from apache.

It is not recommended that you disable this rule if you have a false positive.  If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system.  Instructions to report false positives are detailed on the [[Reporting False Positives]] wiki page.  If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

'''Tuning Guidance'''

If you are using a module like apaches modreqtimeout to detect slow connections, it may be possible your configuration needs to be adjusted to allow slower connections.

'''Similar Rules'''
None.

'''Knowledge Base Articles'''

None.

'''Outside References'''

None.