Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)

[Solar Designer <solar () openwall com>]

Hi,

FWIW, the approach with per source IP address limits is also used in
ModSecurity's SecReadStateLimit and SecWriteStateLimit directives:

http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual#SecReadStateLimit

SecWriteStateLimit is now being talked about in context of slow read
attacks:

http://blog.spiderlabs.com/2012/01/modsecurity-advanced-topic-of-the-week-mitigation-of-slow-read-denial-of-service-attack.html

Alexander