---
title: "P25: Availability Without Load Testing"
canonical: https://openvapt.com/academy/p25.html
html: https://openvapt.com/academy/p25.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# P25: Availability Without Load Testing

Why a self-assessment never floods a server to test it, and which settings show whether a site can resist floods and slow requests.

- Level: Practitioner
- Time: about 20 minutes
- Read first: F3

## You Will Be Able To

- Explain the difference between performance testing and a configuration review.
- Name the settings that limit request rate, size and duration.
- Know when real load testing is appropriate and who must approve it.

## Two Different Activities

Performance testing sends heavy traffic on purpose to measure speed and find breaking points. Done without permission, the same traffic is a denial of service attack.

A self-assessment instead reads the configuration that decides how the server behaves under pressure. No heavy traffic is sent, so the review is designed not to strain the service.

## What to Look For

Rate limits stop one client sending too many requests. Size limits stop huge uploads. Time limits stop clients that send a request very slowly to hold a worker open.

On nginx these are limit_req_zone, limit_conn_zone and client_max_body_size. On Apache they are mod_reqtimeout and optional modules such as mod_evasive.

## Login Protection

Repeated failed logins are a flood aimed at one door. SSH MaxAuthTries and a log-based blocker such as fail2ban, sshguard or CrowdSec slow attackers down.

## When Real Load Testing Is Right

Before a launch or a big event, a team may load test its own system. Do it on a copy where possible, in an agreed window, with written approval from the owner and the hosting provider.

## In Summary

Never flood a server to assess it. Read its rate, size and time limits instead, and keep real load tests for your own systems, with written approval.

## Apply It

- [WEB-APA-008 Apache Has No Request Filtering Module](https://openvapt.com/checks/WEB-APA-008.md) (info)
- [WEB-APA-011 Apache Has No Slow Request Protection](https://openvapt.com/checks/WEB-APA-011.md) (medium)
- [WEB-NGX-006 nginx Request Limits Not Configured](https://openvapt.com/checks/WEB-NGX-006.md) (info)

## Lab

1. `Run: openvapt demo vulnerable --only WEB-APA-011,WEB-NGX-006 --out p25 and list the missing limits.`
2. `Write the nginx lines that add a login rate limit of 10 requests per minute per address.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. Why does OpenVAPT not send heavy traffic to test availability?
   - A. It is too slow
   - B. Heavy traffic can take a service down and, without permission, is an attack
   - C. Servers block it anyway
   - D. It needs a paid licence
   - Answer: B. Floods can break the system being assessed. A configuration review avoids that risk.

2. What does a slow request attack (Slowloris) exploit?
   - A. Weak passwords
   - B. Workers kept busy by clients that send requests very slowly
   - C. Old TLS versions
   - D. Large images
   - Answer: B. Each slow client holds a worker. Enough of them use up every worker.

3. Which nginx directive limits request rate?
   - A. server_tokens
   - B. limit_req_zone
   - C. autoindex
   - D. ssl_ciphers
   - Answer: B. limit_req_zone defines a shared rate limit, applied with limit_req.

4. Which Apache module protects against slow requests?
   - A. mod_rewrite
   - B. mod_reqtimeout
   - C. mod_ssl
   - D. mod_status
   - Answer: B. mod_reqtimeout sets minimum read rates for headers and bodies.

5. Who must approve a real load test?
   - A. Nobody
   - B. The system owner and, where relevant, the hosting provider, in writing
   - C. Any team member
   - D. Only the firewall
   - Answer: B. Load tests can affect shared infrastructure, so written approval comes first.

## Key Terms

- Rate Limiting: Capping how many requests one client may send in a period, so a flood or a password guessing run slows down.
- Slowloris: An attack that opens many requests and sends them very slowly, keeping every web server worker busy.
- Intrusion Prevention: Automatically blocking a source after repeated suspicious behaviour, for example failed logins seen in the log.
- Brute Force: Trying many passwords or keys in turn until one works.

## References

- [nginx documentation, ngx_http_limit_req_module](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html)
- [Apache HTTP Server, mod_reqtimeout](https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html)

Offline: `openvapt learn P25`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p25.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.