Topic: mod_security crs_11_slow_dos_protection rule False Positive

[pipetka]

Hi,

After modsecurity_crs_11_slow_dos_protection.conf rule activation I receive the following message in the browser:
The connection was reset

And have the following lines in the error.log

[:warn] [pid 4152:tid 1692] ModSecurity: Access denied with code 400. Too many threads [1920] of 250 allowed in READ state from 172.16.1.222 - Possible DoS Consumption Attack [Rejected]

It seems that the cause of such behavior is
SecReadStateLimit 250 variable in modsecurity_crs_11_slow_dos_protection.conf file.

Is that a normal having 1920 threads from one page in the browser? How can I resolve the issue?


Thank you in advance

[Steffen]

Best is to post mod_security questions at their list : https://lists.sourceforge.net/lists/listinfo/mod-security-users . The developers there are always willing to help.