Slowloris Attack: Symptoms and Detection
A security analyst notices that a web server is responding very slowly to legitimate requests. The server logs show many incomplete HTTP GET requests that never complete, each opened slowly over time from many different IP addresses. Which attack is most likely occurring?
Quick Answer
The answer is Slowloris, as this attack is defined by its method of sending numerous incomplete HTTP GET requests from many different IP addresses, each opened slowly to keep connections alive and exhaust the server’s connection pool. This is correct because Slowloris is an application-layer DDoS attack that deliberately sends partial headers, never completing the request, which forces the web server to hold each connection open until it reaches its maximum concurrent limit, thereby denying service to legitimate users. On the Certified Ethical Hacker CEH exam, this scenario tests your ability to distinguish Slowloris from other DoS attacks like SYN flood or HTTP flood; a common trap is confusing it with a volumetric attack, but the key clue is the *slow* sending of partial requests from multiple sources. Remember the memory tip: “Slowloris sends slow, partial headers to hold the door open—think of a lazy lizard that never finishes its meal.”
⚠ Common exam trap
Many candidates confuse a SYN flood (TCP layer) with Slowloris (HTTP layer) because both involve incomplete connections, but the key distinction is that Slowloris targets the HTTP protocol with partial GET requests, not the TCP handshake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Slowloris
Slowloris is a denial-of-service attack that works by opening multiple HTTP connections to a target web server and sending partial HTTP GET requests, never completing them. The server keeps these connections open waiting for the request to finish, eventually exhausting its connection pool and denying service to legitimate users. The key indicators are many incomplete GET requests from diverse IPs and slow server response, which match the scenario exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ping of Death
Why it's wrong here
Ping of Death uses oversized ICMP packets, not HTTP.
- ✗
HTTP flood
Why it's wrong here
HTTP flood sends many complete requests, not partial slow ones.
- ✗
SYN flood
Why it's wrong here
SYN flood involves TCP SYN packets, not incomplete HTTP requests.
- ✓
Slowloris
Why this is correct
Slowloris sends slow partial HTTP headers to keep connections open.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?
medium- A.HTTP flood
- ✓ B.Slowloris attack
- C.SYN flood
- D.UDP flood
Why B: The Slowloris attack works by opening multiple HTTP connections to the target web server and sending partial HTTP headers, then keeping those connections alive by sending periodic small packets to prevent timeout. This exhausts the server's connection pool, leading to slow response times and denial of service for legitimate users, matching the described symptoms of incomplete requests and long-held connections.
Variation 2. An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?
hard- A.UDP flood
- B.SYN flood
- ✓ C.Slowloris
- D.HTTP flood
Why C: Slowloris is a low-and-slow application-layer DoS attack that opens multiple HTTP connections to the target server and keeps them alive by sending partial HTTP GET requests with random parameters, never completing the request. This exhausts the server's connection pool, preventing legitimate users from connecting, while each request takes a long time due to the server waiting for the final headers.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.