how to block spam on forums application

2048 bytes of payload was what I was suggesting as a start point to protect against the slow HTTP payload delivery attack that was popularized a few weeks ago. I believe TMM will timeout the collection if it only receives a portion of the data. So it seemed like a small enough amount of data to wait for before deciding whether the request was a slow payload attack.

 

 

For this scenario, I'd try recording a few POST requests that have suspect payloads (ie spam) and see how many bytes into the payload they are.

 

 

Aaron