Availability Without Load Testing

Two Different Activities

Performance testing sends heavy traffic on purpose to measure speed and find breaking points. Done without permission, the same traffic is a denial of service attack.

A self-assessment instead reads the configuration that decides how the server behaves under pressure. No heavy traffic is sent, so the review is designed not to strain the service.

What to Look For

Rate limits stop one client sending too many requests. Size limits stop huge uploads. Time limits stop clients that send a request very slowly to hold a worker open.

On nginx these are limit_req_zone, limit_conn_zone and client_max_body_size. On Apache they are mod_reqtimeout and optional modules such as mod_evasive.

Login Protection

Repeated failed logins are a flood aimed at one door. SSH MaxAuthTries and a log-based blocker such as fail2ban, sshguard or CrowdSec slow attackers down.

When Real Load Testing Is Right

Before a launch or a big event, a team may load test its own system. Do it on a copy where possible, in an agreed window, with written approval from the owner and the hosting provider.

In Summary

Never flood a server to assess it. Read its rate, size and time limits instead, and keep real load tests for your own systems, with written approval.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo vulnerable --only WEB-APA-011,WEB-NGX-006 --out p25 and list the missing limits.
2. Write the nginx lines that add a login rate limit of 10 requests per minute per address.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• nginx documentation, ngx_http_limit_req_module
• Apache HTTP Server, mod_reqtimeout

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P25: Availability Without Load Testing (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p25.html

@misc{openvapt_p25,
  author       = {{OpenVAPT}},
  title        = {{P25: Availability Without Load Testing}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p25.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}