Light

Episode #944 Quiz

Abusing HTTP/2 Rapid Reset
Date: 2023-10-17 | Length: 2 hrs | Episode page at twit.tv

About this episode

The episode explains HTTP/2 Rapid Reset, a DDoS technique abusing stream multiplexing and RST_STREAM cancellation. Attackers open many streams, immediately reset them, and force servers or proxies to allocate, parse, decompress headers, and forward resets, creating cost asymmetry. Mitigations include GOAWAY, throttling, heuristics, blacklisting, or disabling HTTP/2.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what did Google say was the main reason HTTP/2 became an attractive DDoS target compared with HTTP/1.1?

Question 1

According to the episode, what did Google say was the main reason HTTP/2 became an attractive DDoS target compared with HTTP/1.1?

Its pipelining model forces requests to be processed strictly in order Its reliance on UDP makes source spoofing easier than with TCP Its TLS handshake requires extra CPU work that attackers can exhaust more cheaply Its stream multiplexing raises legitimate connection efficiency in ways attackers can abuse

Question 2: What did the attacker do in the Rapid Reset technique immediately after sending an HTTP/2 request?

Question 2

What did the attacker do in the Rapid Reset technique immediately after sending an HTTP/2 request?

It sent a GOAWAY frame to shut down the entire connection cleanly It sent a RST_STREAM frame to cancel the request right away It retransmitted the same request until the server returned an error It closed the TCP connection so the server would free the stream slot

Question 3: Which mitigation did Google say should not be used as the primary defense because it leaves the connection vulnerable too long?

Question 3

Which mitigation did Google say should not be used as the primary defense because it leaves the connection vulnerable too long?

Immediate blacklisting of every client IP that opens more than one stream Reducing the server’s maximum frame size to slow header delivery A graceful GOAWAY sequence that waits a round trip before forbidding new streams Disabling TLS 1.2 and requiring a newer transport handshake

Question 4: How did Steve describe the likely best large-scale defense for servers facing this attack?

Question 4

How did Steve describe the likely best large-scale defense for servers facing this attack?

Allow every canceled stream to remain active until the response is ready Convert all HTTP/2 traffic to HTTP/3 over QUIC Dynamically throttle or blacklist abusive source IPs at the perimeter Increase the number of concurrent streams allowed per connection

Question 5: What did Steve say ValiDrive currently requires, and what environment did he note it can still run under?

Question 5

What did Steve say ValiDrive currently requires, and what environment did he note it can still run under?

It requires a bootable DOS environment, but it can run inside a browser tab It requires Linux, but it can run under WINE on Windows It requires macOS, but it can run natively on iOS It requires Windows, but it can run in Parallels on an ARM Mac

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.