11

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?

6

Since DDoS is not really a specific attack, on a specific vulnerability, testing for it is kinda pointless, especially since there's not much you can do about it anyway, except for scaling out more. (See my answer here for explanation why).

What you should be doing, is doing load testing - if you can handle 100K legitimate clients, you know thats how much you can scale against DDoS... and a DDoSer would need to scale up his botnet that much in order to succeed in attacking you. If you can't - well, then DDoS isn't really your issue, is it? (Of course, replace 100K with any number that makes sense for your site, given your business, risk, availability requirements, exposure, etc).

If you're just looking for a way to simulate that, the best way I can think of is some form of "cloud" based systems, e.g. throw up a large pile of virtualized machines on Amazon's systems and have them all go to your system. Of course, these would all come from similiar IPs, and DDoS come from all over - so maybe in addition to Amazon, you also want Azure, and also etc etc.....

  • 1
    There are services (both legitimate and non) that will "stress test" or "load test" your website. The legitimate ones want proof that you own the site before they DDoS you. – Ladadadada May 4 '14 at 17:43
  • @Ladadadada sure, now there are. I don't think there were any when I wrote that answer... or at least, I'm not familiar with any :-) – AviD May 4 '14 at 21:10
  • Wow, didn't notice how old this question and answer are. I wonder how I ended up finding it... Oh, close votes probably. – Ladadadada May 4 '14 at 21:31
1
  • juno-z.101f.c
  • bang.c
  • dnos.c
  • Pyloris
  • That new, slow POST attack

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.