This directive enables operating system specific optimizations for a
listening socket by the Protocol type.
The basic premise is for the kernel to not send a socket to the server
process until either data is received or an entire HTTP Request is buffered.
Only
FreeBSD's Accept Filters, Linux's more primitive
TCP_DEFER_ACCEPT , and Windows' optimized AcceptEx()
are currently supported.
Using none for an argument will disable any accept filters
for that protocol. This is useful for protocols that require a server
send data first, such as ftp: or nntp :
AcceptFilter nntp none
The default protocol names are https for port 443
and http for all other ports. To specify that another
protocol is being used with a listening port, add the protocol
argument to the Listen
directive.
The default values on FreeBSD are:
AcceptFilter http httpready
AcceptFilter https dataready
The httpready accept filter buffers entire HTTP requests at
the kernel level. Once an entire request is received, the kernel then
sends it to the server. See the
accf_http(9) man page for more details. Since HTTPS requests are
encrypted, only the
accf_data(9) filter is used.
The default values on Linux are:
AcceptFilter http data
AcceptFilter https data
Linux's TCP_DEFER_ACCEPT does not support buffering http
requests. Any value besides none will enable
TCP_DEFER_ACCEPT on that listener. For more details
see the Linux
tcp(7) man page.
The default values on Windows are:
AcceptFilter http connect
AcceptFilter https connect
Window's mpm_winnt interprets the AcceptFilter to toggle the AcceptEx()
API, and does not support http protocol buffering. connect
will use the AcceptEx() API, also retrieve the network endpoint
addresses, but like none the connect option
does not wait for the initial data transmission.
On Windows, none uses accept() rather than AcceptEx()
and will not recycle sockets between connections. This is useful for
network adapters with broken driver support, as well as some virtual
network providers such as vpn drivers, or spam, virus or spyware
filters.
The data AcceptFilter (Windows)
For versions 2.4.23 and prior, the Windows data accept
filter waited until data had been transmitted and the initial data
buffer and network endpoint addresses had been retrieved from the
single AcceptEx() invocation. This implementation was subject to a
denial of service attack and has been disabled.
Current releases of httpd default to the connect filter
on Windows, and will fall back to connect if
data is specified. Users of prior releases are encouraged
to add an explicit setting of connect for their
AcceptFilter, as shown above.
See also
