All DDoS Definitions
DDoS Testing Definition

RUDY Attack (R-U-Dead-Yet)

When a server holds a worker open waiting for the body of a POST that arrives one byte at a time, a handful of connections can fill the entire pool. That is a RUDY attack. Short for R-U-Dead-Yet, it is one of the low-bandwidth application-layer cases a thorough DDoS test has to cover, because the traffic is far too thin for a volumetric control to notice.

It is one variant of the low and slow attack: open connections and keep each barely alive so the resource that runs out is concurrency, not bandwidth. What is specific to RUDY is where it plants the stall, in the request body.

RUDY: a slow POST body that never finishes arriving Slow POST request POST /upload Content-Length: 10000000 body sent 1 byte per long interval near-zero traffic a few of these are enough holds a worker Worker thread pool waiting for body waiting for body waiting for body pool exhausted no free workers no slot Legit user request stalls The slow-POST counterpart to Slowloris: it exploits the server's willingness to wait, not its bandwidth A test characterizes how many slow POSTs exhaust the workers and whether request-body timeouts and rate floors are set. BlackNeuron™
A RUDY attack sends an HTTP POST with a large declared Content-Length then dribbles the body one byte at a time, holding every worker thread until the connection pool is exhausted.

The dribbled POST body

The attacker sends an HTTP POST with a large declared Content-Length, then feeds the body a byte or two at a time, pausing just short of the receive timeout between each. The server, told a large body is on its way, keeps the connection and its worker reserved, reading the trickle and waiting for a body that arrives glacially. The request never errors and never completes.

That placement is the whole distinction. Its siblings freeze a different phase: Slowloris holds the headers unfinished, and a slow read attack throttles the response instead of the request. RUDY freezes the body of the POST. All three exhaust the same worker pool by different routes.

The natural target is any endpoint that legitimately accepts large uploads, a file upload or a long form, because a large Content-Length is unremarkable there. The malicious POST looks like a slow client on a big form rather than anything an inspecting device would flag.

Why it slips past volume defenses

The bandwidth is trivial, the HTTP is valid, and the declared body size, however enormous, is a legal header. A rate limiter keyed on requests per second or bytes per second never trips, and a few hundred concurrent slow POSTs can consume every worker in a thread-per-connection server. As with the rest of the family, the server's concurrency model decides how exposed it is: a thread-per-connection origin has a hard, low ceiling, while an event-driven server that multiplexes many connections per worker resists the classic form and forces the attacker to find a different finite resource.

In a test the vector is usually reproduced with slowhttptest in its slow-POST mode, which opens the connections and manages the dribble so the operator can watch the worker pool fill.

RUDY attack: a POST body dribbled one byte at a time slow-POST clients, huge Content-Length worker pool each unfinished POST keeps a worker reserved legitimate request, no free worker app server reads the body, waiting body still arriving, connection held A body receive-timeout and a minimum data-rate floor close it; a rate limit never sees it BlackNeuron™
Animated RUDY attack: a few slow-POST clients each declare a huge Content-Length and trickle the body, so every worker in a fixed pool stays reserved and a legitimate request finds no free slot.

What a DDoS test measures

The output is not a bandwidth figure. A RUDY test measures how many concurrent slow POSTs it takes to exhaust available workers, whether a request-body receive timeout and a minimum data-rate floor on the body are configured (distinct from the header timeout that catches Slowloris), and how a reverse proxy that buffers the complete request before forwarding changes the outcome. A proxy that waits for the whole body absorbs the stall at the edge, where a stalled connection is cheap, instead of at the origin's worker pool where it is expensive.

The number that matters is how many held connections it takes before a real visitor is turned away, and how fast the pool empties once the trickle stops. Where the slow-POST case fits among the other application-layer vectors, and how a test drives them together, is covered in Application-Layer (L7) DDoS Testing.