From 733a506cedad7087ce2d96f5664eb0fc03959d8d Mon Sep 17 00:00:00 2001 From: Aaron Suggs Date: Wed, 6 Mar 2013 16:39:02 -0500 Subject: [PATCH] README: add performance section --- README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/README.md b/README.md index 681dd73..a50fbc7 100644 --- a/README.md +++ b/README.md @@ -154,6 +154,19 @@ You can subscribe to 'rack.attack' events and log it, graph it, etc: puts req.inspect end +## Performance + +The overhead of running Rack::Attack is typically neglible (a few milliseconds per request), +but it depends on how many checks you've configured, and how long they take. +Throttles usually require a network roundtrip to your cache server(s), +so try to keep the number of throttle checks per request low. + +If a request is blacklisted or throttled, the response is a very simple Rack response. +A single typical ruby web server thread can block several hundred requests per second. + +If you need something more efficient but less flexible than Rack::Attack, +check out `iptables` and nginx's [limit_zone module](http://wiki.nginx.org/HttpLimitZoneModule). + ## Motivation Abusive clients range from malicious login crackers to naively-written scrapers.