I would guess that Varnish isn't affected by this, but does anyone know for sure? Does Varnish protect against this attack in all cases if you have Apache as your backend? http://isc.sans.org/diary.html?storyid=6601 Many thanks, Nick.