Web Timeouts and Their Implications

Timeouts play a fundamental role in network protocols, controlling numerous aspects of host behavior at different layers of the protocol stack. Previous work has documented a class of Denial of Service (DoS) attacks that leverage timeouts to force a host to preserve state with a bare minimum level of interactivity with the attacker. This paper considers the vulnerability of operational Web servers to such attacks by comparing timeouts implemented in servers with the normal Web activity that informs our understanding as to the necessary length of timeouts. We then use these two results--which generally show that the timeouts in wide use are long relative to normal Web transactions--to devise a framework to augment static timeouts with both measurements of the system and particular policy decisions in times of high load.