DoS / DDoS Simulator — Volumetric & Application-Layer Attack Detection
Volumetric attacks are trivially visible and largely a bandwidth-procurement problem. Application-layer attacks are the ones that hurt, and they hide beneath every volumetric threshold — which is why response time and error rate, not request count, are the metrics that matter.
Open in Red Team Toolkit — ddosDoS / DDoS Simulator — Volumetric & Application-Layer Attack Detection
Volumetric attacks are trivially visible and largely a bandwidth-procurement problem. Application-layer attacks are the ones that hurt, and they hide beneath every volumetric threshold — which is why response time and error rate, not request count, are the metrics that matter.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| NetFlow / IPFIX | packet_count / byte_count / flow_duration | Packet and connection counters at the network layer. The primary signal for volumetric and reflection attacks. A SYN flood appears as a massive increase in half-open TCP flows with no corresponding ACK. A reflection attack appears as a spike in UDP traffic from unexpected source ports (DNS/53, NTP/123, memcached/11211) to a single destination. |
| Load Balancer / CDN Log | request_rate / connection_table / health_check_status | Request rate, active connection count, and origin health check results. A saturated connection table causes new legitimate connections to be dropped before they appear in access logs — health check failures are often the first alert that an attack is succeeding. |
| Web Access / Error Log | status_code / response_time | 503 volume and response time degradation. These are the metrics that define whether an attack succeeded from the user perspective. A volumetric attack that is absorbed at the CDN produces no 503s; an L7 exhaustion attack targeting a slow database endpoint produces 503s and high response times at low request volume. |
| APM / Synthetic Monitoring | latency_p99 / error_rate | The metric that actually defines whether an attack succeeded. Synthetic probes from outside your network confirm whether the service is reachable from a user perspective, independent of what your internal metrics show. An attack that degrades P99 latency above SLA thresholds has succeeded even if request volume looks normal. |
Detection rules
title: TCP SYN Flood — High SYN Rate per Destination
id: b8c9d0e1-f2a3-4567-bcde-678901234567
status: experimental
description: >
Counts TCP SYN packets per destination over 1 minute. A threshold of
10,000 SYN/min is a conservative starting point — tune to 3x your
legitimate peak SYN rate for the destination. Requires firewall or
flow telemetry with per-packet flag visibility.
logsource:
category: firewall
detection:
selection:
tcp.flags: SYN
tcp.flags_ack: false
timeframe: 1m
condition: selection | count() by dst.ip > 10000
falsepositives:
- Flash-crowd traffic spikes from legitimate viral events
- Load testing during authorised performance tests
level: high
tags:
- attack.impact
- attack.t1498Evasion & counters
Low-volume L7 attacks targeting expensive endpoints (database queries, file uploads, search) that exhaust backend resources without triggering volumetric thresholds.
Monitor response time and error rate per endpoint rather than request volume. The L7 Splunk query above uses req_ratio, avg_rt_ms, and 503 count as the signal — an endpoint that is slow and erroring under modest load is the pattern to catch.
Slowloris and slow-body attacks that hold connections open by sending headers or body bytes extremely slowly, exhausting the connection table without sending many packets.
Monitor concurrent connections and time-to-first-byte at the reverse proxy. Enforce request timeout, header timeout, and body read timeout at the proxy layer — most default configurations have no timeout or a very long one. Nginx: client_header_timeout, client_body_timeout. Apache: RequestReadTimeout.
Wide botnet distribution spreading traffic across thousands of source IPs so no individual source triggers per-source rate limits.
Detect at the aggregate destination level — the VOLUMETRIC_DISTRIBUTED classifier above fires on the destination traffic shape regardless of how many sources contribute. Source-based rate limiting is ineffective against wide distribution; destination-aggregate detection is not.
Rotating attack targets across multiple endpoints to stay below per-path thresholds.
Aggregate at the service and origin level as well as per path. A service whose total error rate or average response time is degrading is under attack even if no single endpoint exceeds its individual threshold.
Rule tuning
Preventive control
Upstream scrubbing or CDN absorption for volumetric attacks — the CDN absorbs the traffic before it reaches your origin. Edge rate limiting and bot management for L7 attacks. SYN cookies and connection timeouts at the load balancer to resist SYN floods without dropping legitimate traffic. Autoscaling with a hard budget ceiling so an attack degrades service gracefully rather than exhausting your cloud spend — autoscaling without a ceiling turns a DoS into a bill.