DDoS Attack Simulator

Overview

A distributed denial of service attack tries to make a service unavailable by flooding it with more traffic than it can handle. This simulator puts you in charge of defending a server against waves of attack traffic of increasing intensity. You can choose the attack type: an HTTP flood that sends application requests, a SYN flood that opens TCP connections and never completes them, or a UDP flood that saturates bandwidth with datagrams. As the attack runs, the server health drops with the load and the counters show requests per second, total requests and how many were blocked. You defend with layers: a firewall that filters traffic, a load balancer that spreads it, and automatic rate limiting that throttles clients sending too much. The firewall and the rate limiter block part of the attack, the load balancer reduces the damage from what gets through, and survival time, waves and achievements reward a setup that holds. The point is that no single control stops every kind of flood, so real protection combines filtering, rate limiting, spare capacity and, for large attacks, an upstream mitigation service or CDN.

Try this

1. Start an HTTP flood with no defenses and watch how quickly the server health falls.
2. Turn on the firewall, the load balancer and automatic rate limiting one at a time and compare the blocked request counts.
3. Switch to a SYN flood or UDP flood and see which defenses still help.

Frequently asked questions

What is the difference between a DoS and a DDoS attack?

A denial of service attack comes from one source, which can often be blocked. A distributed attack comes from many machines, often a botnet, so blocking single addresses does not stop it.

What is a SYN flood?

An attack that sends many TCP SYN packets without completing the handshake, filling the server table of half-open connections. SYN cookies and upstream filtering are common defenses.

Does rate limiting stop DDoS attacks?

It helps against application-layer floods from a limited set of clients, but large volumetric attacks saturate the network before your server sees them. Those need upstream protection, such as a CDN or a scrubbing service.