Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?

share|improve this question

Since DDoS is not really a specific attack, on a specific vulnerability, testing for it is kinda pointless, especially since there's not much you can do about it anyway, except for scaling out more. (See my answer here for explanation why).

What you should be doing, is doing load testing - if you can handle 100K legitimate clients, you know thats how much you can scale against DDoS... and a DDoSer would need to scale up his botnet that much in order to succeed in attacking you. If you can't - well, then DDoS isn't really your issue, is it? (Of course, replace 100K with any number that makes sense for your site, given your business, risk, availability requirements, exposure, etc).

If you're just looking for a way to simulate that, the best way I can think of is some form of "cloud" based systems, e.g. throw up a large pile of virtualized machines on Amazon's systems and have them all go to your system. Of course, these would all come from similiar IPs, and DDoS come from all over - so maybe in addition to Amazon, you also want Azure, and also etc etc.....

share|improve this answer
There are services (both legitimate and non) that will "stress test" or "load test" your website. The legitimate ones want proof that you own the site before they DDoS you. – Ladadadada May 4 '14 at 17:43
@Ladadadada sure, now there are. I don't think there were any when I wrote that answer... or at least, I'm not familiar with any :-) – AviD May 4 '14 at 21:10
Wow, didn't notice how old this question and answer are. I wonder how I ended up finding it... Oh, close votes probably. – Ladadadada May 4 '14 at 21:31
  • juno-z.101f.c
  • bang.c
  • dnos.c
  • Pyloris
  • That new, slow POST attack
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.