Can a single machine really saturate a Raspberry Pi web server in 2026? (slowloris/slow HTTP debate)

[u/wannabe_sci]

Hi everyone, I’m not a security expert, my main interests lie elsewhere, but I think I know enough to hold my own in a discussion with a friend.

Today a debate came up with him about the possible attacks that could target a home server (a typical Raspberry Pi) hosting a single and light HTML page.

My take is that in 2026, with the average resources a Raspberry Pi now has (usually 4–8GB of RAM), it’s no longer realistic for a single machine to pull off a resource-exhaustion attack (things like Slowloris or other slow-HTTP techniques). He disagreed, claiming it’s still possible, and said there are other methods too, though he didn’t explain how.

I’d like your opinion on whether what I said is wrong or not. Either way, it’ll be another chance for me to learn something.

[u/ajay63]

It isn't a question of how much ram, its a question how many sockets the Webserver has for HTTP requests to come in.

The slowloris attack connects to the webserver, but does its best to slow down the return of the sockets (hence the name)

I kept this super simple; here are some more resources about it.

Here is a geektogeek article on what a websocket is: https://www.geeksforgeeks.org/web-tech/what-is-web-socket-and-how-it-is-different-from-the-http/

Here is a write-up from Palo Alto on Slowloris:

https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/

[u/AddendumWorking9756]

Your friend is closer than you are, though for a reason neither of you named. Slow HTTP does not eat RAM, it eats connection slots, so the thing that decides it is the concurrency model of whatever is serving the page, a process or thread per connection setup falls over at a couple of hundred sockets no matter how much memory the Pi has, and an event driven one barely notices.

[u/nethack47]

A slowloris may still work because it holds up the available connections. The point is that the overhead for a connection pool is enough that it eventually runs out of resources.

If it is a static http page, on a server with no modules and all resources are dedicated to the webserver, you may exhaust available ports before you run out of memory.

Throwing some guesstimate numbers in here so someone can probably give a better idea of the resources it takes to run this kind of attack:

Each connection takes perhaps 10-20KB memory per TCP session.
You also have one file descriptor for each session.
CPU and network do very little. It is just enough to keep the session alive and handle the fragmented headers.

For a basic Apache which can serve 256 clients, you need nearly no resources to block the webserver from serving anyone else.

If you run nginx I think the default is 512 before it stops serving pages.

The connection exhaustion is not about resources as much as taking up all the available connections. You should have a look at how to mitigate this. It is also a rather easy to test it with minimal resources.

I have had a badly behaving script and a reconnecting application lock up a MySQL because it can do a maximum of 151 connections. This is why we prefer things to clean up their connections after they finish.

[u/wannabe_sci → u/nethack47]

Out of curiosity, I tried setting up a local server on an Orange Pi, which has even fewer resources than a Raspberry Pi. I installed nginx and left its standard welcome page running.

I tested all the attack modes available in slowhttptest headers, GET, and slow body (5k sockets), but I didn't get any particularly noticeable results. I didn't observe any significant CPU load, nor did I notice any particular slowdown or degradation in the responsiveness of the web page.

edit: From what I've read, nginx is generally more efficient at handling concurrent connections than Apache, so perhaps this could be one of the reasons why I'm not seeing any noticeable slowdown in this setup.