Slowloris is HTTP-based, right? In this case I'm not sure they didn't even have to go up to that layer 7, it seems they had some generous time-outs for TCP and SSL idle (or incomplete) sessions