All DDoS Definitions
DDoS Definition

Low and Slow Attack

A low and slow attack is a Layer 7 (application) attack vector, one of the attack classes a thorough DDoS test is built to exercise. Rather than saturating bandwidth, it opens a modest number of connections and feeds each one request data at a deliberately crawling pace, one header or a few body bytes at a time, keeping every session just alive enough to dodge a timeout. Each stalled connection pins a worker thread or socket, so a single host with almost no throughput can drain a server's connection pool. Slowloris and RUDY are the canonical instances; the trait that defines the whole class is that the traffic rate is trivially low.

Low and slow: trickle bytes, pin every worker Single host near-zero bandwidth partial requests, one byte at a time never completes Connection pool (workers) worker · held open, stalled worker · held open, stalled worker · held open, stalled worker · held open, stalled worker · held open, stalled pool full: no free worker Legitimate user normal request needs one worker tries to connect ✕ refused Test drives the receive-timeout, minimum-data-rate, and per-source connection caps that decide whether stalled sessions ever release a worker. BlackNeuron™
Low and slow attack: a single near-zero-bandwidth host feeds partial requests one byte at a time, holding every worker in the connection pool stalled so a legitimate user is refused

Why it matters in DDoS testing

Low and slow attacks are hard to catch because the volume never trips a rate limit keyed on requests or packets per second. A test exercises the controls that actually govern this class: connection and header receive timeouts, minimum-data-rate thresholds, the concurrent-connection ceiling per source, and how fast a server reclaims a worker once a session stalls. A stack tuned only for volumetric floods routinely passes bandwidth tests and still falls to a laptop running one of these. For where slow attacks sit among the application-layer vectors, the receive path is the surface to probe.