Nginx # ngx_http_limit_req_module: How long does 503 return after exceeding the bid?

Question

Say I set

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s; server { location / { limit_req zone=one burst=5 nodelay; } 

Then within 5 seconds I send 10 requests per second.

Which query should see 200 and which should see 503 ?
Will this be the first of every 10 queries?

Or nginx monitor that bad users are continuously sending requests, in which case only the first of 50 requests will receive 200 ?

Answer 1

As stated in the documentation: http://nginx.org/en/docs/http/ngx_http_limit_req_module.html nginx uses the "leaky bucket" algorithm, which is simple and fairly common in the network area. You can read about it on wikipedia: http://en.wikipedia.org/wiki/Leaky_bucket

As for your question ( rate=1r/s burst=5 nodelay ), in practice it will be something like this:

  Req. # |  Time (sec) |  Response
    1 0 200 OK
    2 0.1 200 OK
    3 0.2 200 OK
    4 0.3 200 OK
    5 0.4 200 OK
    6 0.5 200 OK
    7 0.6 503
    8 0.7 503
    9 0.8 503
   10 0.9 503
   11 1.0 200 OK
   12 1.1 503
   13 1.2 503
   14 1.3 503
   15 1.4 503
   16 1.5 503
   17 1.6 503
   18 1.7 503
   19 1.8 503
   20 1.9 503
   21 2.0 200 OK
   22 2.1 503
   23 2.2 503
   24 2.3 503
   25 2.4 503
   26 2.5 503
   27 2.6 503
   28 2.7 503
   29 2.8 503
   30 2.9 503
   31 3.0 200 OK
   32 3.1 503
   33 3.2 503
   34 3.3 503
   35 3.4 503
   36 3.5 503
   37 3.6 503
   38 3.7 503
   39 3.8 503
   40 3.9 503
   41 4.0 200 OK
   42 4.1 503
   43 4.2 503
   44 4.3 503
   45 4.4 503
   46 4.5 503
   47 4.6 503
   48 4.7 503
   49 4.8 503
   50 4.9 503