All DDoS Definitions
DDoS Definition

Slow Read Attack

A slow read attack is a Layer 7 (application) "low and slow" attack vector, one of the attack classes a thorough DDoS test is built to exercise. It is the mirror image of Slowloris: instead of sending a request slowly, the attacker sends a complete request and then reads the response as slowly as possible. By advertising a tiny TCP receive window (sometimes a single byte), the client tells the server it can only accept data in minuscule increments. The server has a full response ready but cannot flush it, so the connection and its send buffer stay pinned open for a long time. A few hundred such connections, each costing the attacker almost no bandwidth, can hold every worker and socket the server has.

Slow read: tiny receive window, buffer can't drain Attacker sends a full, valid request, then reads the reply very slowly TCP window = 1 byte near-zero bandwidth complete request reads 1 byte at a time Server worker full response ready but client won't accept it send buffer fills, cannot flush socket blocked on write worker pinned open, never freed Legitimate user needs a free worker from the same pool tries to connect ✕ no worker left Test drives the send-timeout, minimum client receive-rate, and per-source connection cap that decide whether a stalled reader ever releases its worker. BlackNeuron™
Slow read attack: the client advertises a near-zero TCP receive window so the server cannot drain its response buffer, pinning each worker open at near-zero attacker bandwidth

Why it matters in DDoS testing

A slow read attack evades any control keyed on request rate or request size, because the requests themselves are valid and complete; the abuse lives entirely on the read side. A DDoS test validates the defenses that actually apply here: the send-timeout, the minimum client receive-rate the server will tolerate, and the per-source connection cap that decides whether a stalled reader ever releases its worker. Stacks hardened only against fast floods routinely fail this one, which is why slow reads belong in DDoS resilience testing.