A Slow POST attack sends a complete, legitimate HTTP POST header, which includes a Content-Length field to specify the size of the message body to follow. However, the attacker then proceeds to send the actual message body at an extremely slow rate (e.g. 1 byte/110 seconds). Due to the entire message being correct and complete, the target server will attempt to obey the Content-Length field in the header and wait for the entire body of the message to be transmitted. The attacker establishes hundreds or even thousands of such connections until all resources for incoming connections on the affected server are exhausted, making any further connections impossible until all data has been sent.
Unlike other DDoS or DDoS attacks, which try to subdue the server by overloading its network or CPU, an HTTP slow POST attack targets the logical resources of the target, which means the target would still have enough network bandwidth and processing power to operate. Combined with the fact that the Apache HTTP Server will, by default, accept requests up to 2GB in size, this attack can be particularly powerful. HTTP slow POST attacks are difficult to differentiate from legitimate connections and are therefore able to bypass some protection systems.