title: IIS 8.5 low minBytesPerSecond not working against slow HTTP POST
body: <p>I have an ASP.NET site running under IIS 8.5 on Windows 2012 R2.</p>
  
  <p>I'm trying to use the <strong>MinBytesPerSecond</strong> configuration setting (in applicationHost\WebLimits) as part of a strategy to mitigate slow HTTP POST attacks but can't seem to get IIS to respect the value. I've tried with default 240 bytes/sec plus much higher values.</p>
  
  <p>I'm using OWASP/ProactiveRISK's SwitchBlade to trickle a POST body at 1 byte/sec to the server but cannot get it to drop the connection.</p>
  
  <p>The use of MinBytesPerSecond is recommended in a number of articles on the web relating to slow DOS attacks and so I am surprised I am having difficulty. I have restarted IIS after each setting change just in case.</p>
  
  <p>Could this setting be monitored by another process which might not be running?</p>
  
  <p>Any ideas, things to consider or alternatives greatly appreciated.</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Just noted this in the IIS config reference <a href="http://www.iis.net/configreference/system.applicationhost/weblimits" rel="noreferrer">here</a>, minBytesPerSecond... </p>
  
  <blockquote>
    <p>Specifies the minimum throughput rate, in bytes, that HTTP.sys enforces when it <strong><em>sends a response to the client</em></strong>. The minBytesPerSecond attribute prevents malicious or malfunctioning software clients from using resources by holding a connection open with minimal data. If the throughput rate is lower than the minBytesPerSecond setting, the connection is terminated.</p>
  </blockquote>
  
  <p>Does this mean that this setting only applies to the rate at which the response is returned i.e. could only be used against slow <em>reads</em> - does anyone have any knowledge or experience of minBytesPerSecond working for them?</p>
  
  <p>Thanks.</p>