# What Is DDoS Attack Simulation? How Are Corporate Systems Tested? **URL:** https://securesys.com.tr/en/learning/ddos-simulation/what-is-ddos-attack-simulation ![What Is DDoS Attack Simulation? How Are Corporate Systems Tested?](/images/bilgi-merkezi/covers/cover-ddos-03.webp) Having an anti-DDoS service, using a WAF, publishing through a CDN and running DoS protections on the firewall are all important security layers for an organisation. But whether they actually work is usually only understood under real traffic. Because an architecture that looks correct on paper can behave differently under load. A firewall can exhaust its resources before reaching the expected connection count. A WAF can notice a layer 7 attack late. A CDN may not protect the origin server adequately. An anti-DDoS service may not engage at the right threshold. The SOC may notice the attack late. And the application can become unusable because of a backend bottleneck even though the network is entirely healthy. In modern corporate cyber security, therefore, buying a DDoS protection product is not enough. **DDoS resilience must be tested.** This exercise can generally be called **DDoS attack simulation**, **DDoS resilience testing** or **DDoS security validation**. DDoS attack simulation is an authorised security test aimed at measuring how resilient an organisation's internet services, network infrastructure, WAF, CDN, anti-DDoS, firewall, DNS, applications and SOC processes are under controlled traffic scenarios. The aim is not to create a real attack. The aim is to measure safely how resilient the organisation's defensive chain is before a real attack happens. #### What Is a DDoS Attack Simulation? A **DDoS attack simulation** is the measurement of an organisation's technical and operational resilience against distributed denial of service attacks by generating controlled, authorised traffic. During this test the following can be assessed together; - the internet connection, - the firewall, - routers, - the load balancer, - the CDN, - the WAF, - anti-DDoS, - the scrubbing centre, - the DNS infrastructure, - web applications, - API services, - the SOC, - the SIEM, - incident response. All of it as one chain. The most important point here is this: **A DDoS test is not merely a traffic test.** A genuine DDoS resilience assessment is at the same time a **security control validation** exercise. ### What Is the Purpose of a DDoS Test? The purpose of a professional DDoS test is not to crash the system. The purpose is to understand the system's limits. Answers can be sought to questions such as: #### How many Gbps of attack traffic can the organisation absorb? #### At what PPS level does the firewall become affected? #### How does the load balancer behave as CPS rises? #### How long does the WAF take to detect a layer 7 attack? #### Does anti-DDoS engage automatically? #### How long does traffic take to divert to the scrubbing centre? #### How many minutes does the SOC take to see the alert? #### At which point is real user experience affected? #### How long does the system take to return to normal once the attack ends? The answers show the organisation's real DDoS readiness level. ### The Difference Between a DDoS Test and a Real DDoS Attack In a real DDoS attack the attacker's aim is to cut off the service. In a controlled DDoS test the aim is to measure the resilience level while protecting the service. During the test, therefore; the traffic volume, the packet rate, the test duration, the target systems, the protocols used, the stop conditions must be defined in advance. In a professional test the attack traffic is increased in a controlled, graduated manner. The test can be stopped when the system approaches critical thresholds. **Stop conditions** are therefore one of the most important components of DDoS tests. ### Can a DDoS Test Be Carried Out in Production? Yes, it can. But it must be done under tight control. The most valuable results from a DDoS test usually come from the real production architecture. Because in a test environment; the real firewall, the real WAF, the real CDN, the real routing, the real application load may not be fully represented. But the risks of a production test are higher too. Clear **rules of engagement (RoE)** must therefore be established before the test begins. ### Why Are Rules of Engagement Critical in a DDoS Test? The RoE defines the boundaries within which the DDoS test will be carried out. For example; which IPs will be tested, which domains are in scope, which protocols will be used, what the maximum traffic level will be, how many minutes the test will last, which hours it will run in, under what conditions it will be stopped must all be determined in advance. The necessary coordination with the ISP, CDN and anti-DDoS providers must also take place. A badly planned test can affect legitimate third-party systems. ### How Is the DDoS Test Scope Determined? The scope of the DDoS test must be determined according to the organisation's critical services. The scope may include; #### Public Web Site the corporate website. #### E-Commerce Platform the online sales system. #### API Gateway mobile application or partner services. #### DNS Infrastructure authoritative DNS services. #### VPN Gateway the remote access infrastructure. #### Authentication Service login and identity services. #### Public IP Blocks internet-facing network assets. Any of these can be in scope. But every system does not have to be tested at once. Prioritisation can be made on risk and business criticality. ### Identifying Critical Assets Before a DDoS test begins, which of the organisation's internet services are business-critical must be determined. In a bank, for example; mobile banking, internet banking, payment APIs may be critical. In an e-commerce company; the website, the payment service, the login API may take priority. In a SaaS company; the customer portal, the API, the authentication service may be critical. This approach connects the test directly to business risk. ### What Is a Baseline? Normal traffic behaviour must be measured before the DDoS test. This measurement is called the **traffic baseline**. Under normal conditions the values for; bandwidth, PPS, CPS, RPS, latency, CPU, memory, active connections, HTTP error rate are recorded. Without this baseline it becomes hard to interpret the changes occurring during the attack. If latency rises from 50 ms to 200 ms during the test, that may be meaningful. But if the system normally runs at 180 ms, the same result must be interpreted differently. ### Which Metrics Are Monitored in a DDoS Test? In a professional test, traffic volume is not the only thing monitored. The most important metrics include: #### Bandwidth The Mbps / Gbps level. #### Packets Per Second (PPS) Packets per second. #### Connections Per Second (CPS) New connection rate. #### Requests Per Second (RPS) HTTP or API request count. #### Concurrent Connections Connections open at the same time. #### Latency Response delay. #### Packet Loss The rate of lost packets. #### CPU / Memory System resource usage. #### HTTP Error Rate 4xx and 5xx rates. #### Application Response Time The application's response time. #### Mitigation Time How long anti-DDoS takes to engage. ### How Should DDoS Test Traffic Be Increased? In professional tests, traffic is generally increased gradually. Stages such as; 10% capacity, 25% capacity, 50% capacity, 75% capacity, 100% of the target threshold can be used. But fixed percentages are not suitable for every organisation. What really matters is the controlled ramp-up model. Thanks to this approach, security teams can see; at which level the alert fires, at which level performance drops, at which level mitigation begins. ### What Is a Ramp-Up Test? **Ramp-up** means increasing the test traffic gradually rather than all at once. This method matters particularly on production systems. The test can start at 100 Mbps, for example. It can then be raised in a controlled way to levels such as 500 Mbps and 1 Gbps. System behaviour is monitored at each stage. If a critical threshold appears, the traffic is not increased further. This method reduces the risk of a real outage. ### What Is a Burst Test? A **burst test** measures the effect of short, sudden traffic spikes on the system. Real DDoS attacks do not always ramp up slowly. Some attacks can generate very high traffic within seconds. The response of components such as; autoscaling, rate limiting, anti-DDoS detection, the firewall to a sudden load change can therefore be tested. But burst tests must be planned with particular care. ### What Is a Sustained Load Test? Some DDoS attacks are not short but prolonged. The system must therefore be resilient not only to peak traffic but to a sustained attack. A **sustained load test** observes system behaviour while a particular traffic level is maintained over a longer period. The aim may be to see longer-term effects such as; memory leaks, connection accumulation, backend exhaustion, autoscaling behaviour. ### How Is a Volumetric DDoS Test Assessed? The main aim in volumetric tests is to assess network capacity and upstream protection. For example; UDP traffic, ICMP traffic, high bandwidth can be applied in a controlled way. During the test the behaviour of; the ISP, routers, anti-DDoS, the firewall is monitored. The most important question is this: #### Can the attack traffic be filtered before it fills the organisation's internet link? ### What Is an L3/L4 DDoS Test? In layer 3 and layer 4 tests, network and transport layer behaviour is assessed. Scenarios such as; SYN flood, UDP flood, connection flood can be applied in a controlled way. The aim is to measure the limits of components such as; the firewall, the load balancer, the network stack, the connection table. PPS and CPS metrics matter particularly in these tests. ### What Is a Layer 7 DDoS Test? A **layer 7 DDoS test** measures the resilience of web applications or APIs against application layer attacks. Controlled scenarios such as; HTTP GET flood, HTTP POST flood, login intensity, API request flood can be used. The real aim here is not to consume bandwidth but to measure the application's resource consumption. ### Why Does Endpoint Selection Matter in a Layer 7 Test? Not every endpoint consumes the same amount of resources. For example; /static/logo.png consumes very few resources. But; /login /search /report /api/query can create far more processing on the backend. High-cost endpoints must therefore be identified when carrying out a layer 7 test. This approach matters for **application bottleneck analysis**. ### How Is an API DDoS Test Carried Out? In API-based services, the backend workload matters as much as the request count. A single API request can trigger; database queries, authentication, external API calls, a microservice chain. During an API DDoS test, therefore; RPS, response time, backend CPU, database load, error rate must be monitored together. ### What Is a DNS DDoS Test? The DNS infrastructure is critically important for an organisation's internet availability. DNS must therefore be assessed separately in DDoS resilience testing. During the test; DNS QPS, authoritative server response, latency, DNS failover, anycast behaviour can be monitored. When the DNS service stops working, users cannot reach the service even if the web server is up. ### What Is Measured in a CDN DDoS Test? Using a CDN can reduce DDoS risk. But it must be verified that the CDN really is configured correctly. During the test, metrics such as; cache hit ratio, edge response, origin traffic, origin protection, rate limiting can be assessed. If the origin IP is directly reachable in particular, the attacker can try to bypass the CDN. An **origin protection test** is therefore important. ### What Is Measured in a WAF DDoS Test? The WAF is a critical security component against layer 7 attacks in particular. During the test, controls such as; request filtering, rate limiting, bot detection, HTTP anomaly detection, challenge mechanisms can be assessed. The aim is not merely to see whether the WAF raises an alert. The real question is: #### Can it filter malicious traffic without blocking legitimate users? ### Why Do False Positives Matter? Aggressive DDoS protection can also block real users. This situation is assessed as a **false positive**. For example; mobile operator NAT, a corporate proxy, a shared IP, a high-volume genuine customer can be mistakenly identified as a bot. In a DDoS test, therefore, not only the blocking of attack traffic but also **legitimate user availability** must be measured. ### How Is Anti-DDoS Mitigation Time Measured? One of the most important metrics can be **time to mitigate (TTM)**. Once the attack begins, how long does the anti-DDoS solution take to; detect the anomaly, start mitigation, clean the traffic? For example; attack began → 00:00 alert fired → 00:20 mitigation began → 00:45 traffic returned to normal → 01:10 This timeline shows the real attack performance. ### How Is the SOC Measured in a DDoS Test? A DDoS simulation should not be a test of the network teams alone. The SOC must be assessed too. For example; did the alert arrive? did the SIEM create an event? how long did the SOC take to see the alert? was the incident classified correctly? was it escalated to the network team? was contact made with the anti-DDoS provider? did the incident response process start? These questions turn a DDoS test into an operational exercise. ### How Does a SIEM See a DDoS Attack? A SIEM can correlate logs arriving from different sources. For example; the firewall, the WAF, anti-DDoS, the CDN, DNS, NDR, application logs can each show a different trace of the same attack. The value of a SIEM is not raising a single alert but showing the attack as a whole. ### What Is NDR Good for in a DDoS Test? **Network detection and response (NDR)** can detect anomalies by analysing traffic behaviour. Signals such as; a PPS increase, protocol distribution, source diversity, flow anomalies can be monitored. A DDoS simulation can also be used to verify NDR's behavioural analysis capability. ### What Is a DDoS Incident Response Test? The incident response process can be tested alongside the technical DDoS simulation. Communication during the incident between; the SOC, network, applications, management, the ISP, the DDoS provider can be measured. This approach is broader than a technical test. It can also be run alongside a **DDoS tabletop exercise**. ### What Is a DDoS Playbook? A **DDoS incident response playbook** defines who does what once an attack begins. For example; the SOC verifies the alert. Network teams carry out traffic analysis. The ISP or anti-DDoS provider is informed. The application team checks service performance. Management runs the communication process. Responsibilities therefore do not remain unclear during the attack. ### How Are Stop Conditions Determined? One of the most critical safety mechanisms in a DDoS test is the stop condition. The test can be stopped if, for example; latency rises above 2 seconds, packet loss exceeds 5%, CPU reaches 90%, real user errors pass a defined level, a critical service raises an alert. These values must be determined together with the organisation before the test. ### What Is a Kill Switch? In some tests a **kill switch** is the control mechanism allowing test traffic to be halted instantly in an emergency. If an unexpected error appears on a production system, traffic can be cut within seconds. This mechanism matters particularly in high-capacity tests. ### Third-Party Coordination in a DDoS Test Corporate services usually consist of more than the company's own infrastructure. There may also be; an ISP, a cloud provider, a CDN, a DNS provider, an anti-DDoS vendor. Coordination with third parties must therefore take place before the test. Some service providers have their own procedures regarding test traffic. ### DDoS Testing in Cloud Environments DDoS tests on AWS, Azure or other cloud platforms must be planned separately. Cloud providers may have their own usage policies regarding; load testing, DDoS simulation, traffic generation. Before carrying out a test in a cloud environment, the relevant platform rules must therefore be taken into account. Technically high capacity does not mean there is no DDoS risk. Application layer and cost-based attacks can still matter. ### DDoS and Autoscaling In cloud environments, **autoscaling** can add new resources during high traffic. This approach is useful for availability. But unlimited scaling can create another risk: **Economic denial of sustainability (EDoS).** Even if the attack does not bring the service down entirely, it can raise cloud costs sharply. DDoS resilience must therefore be assessed not only for technical capacity but for cost control as well. ### How Is Business Impact Measured in a DDoS Test? Technical metrics alone are not enough. The system may have remained fully reachable, for instance. But response time may have risen from; 300 ms to 4 seconds. For an e-commerce user that is a serious problem. Business metrics such as; transaction success, login success, checkout completion, API SLA, customer experience can therefore also be monitored during the test. ### What Should a DDoS Test Report Contain? A professional DDoS test report should be more than a traffic graph. At minimum it can include the following areas: #### Executive Summary The overall resilience result for management. #### Test Scope The systems tested. #### Traffic Profile Gbps, PPS, CPS and RPS values. #### Attack Scenarios The controlled test scenarios applied. #### System Behavior Firewall, CDN, WAF and application behaviour. #### Mitigation Timeline Detection and blocking times for the attack. #### SOC Response Alert and response processes. #### Bottleneck Analysis The system's weak points. #### Business Impact User and service impact. #### Remediation Recommendations Improvement recommendations. #### Retest Plan Re-verification after the fixes. ### How Should Success Be Defined in a DDoS Test? A successful test does not mean: **“The system never slowed down.”** Better success criteria might be these: The attack was detected correctly. Mitigation started automatically. Real users continued to receive service. The SOC escalated the incident correctly. No network saturation occurred. The application stayed within SLA. The failover mechanism worked. These measurements are far more meaningful. ### How Often Should DDoS Testing Be Done? A single test is not enough. Because infrastructure changes constantly. A new firewall may be purchased. WAF policies may change. The CDN provider may change. A new API may be published. Bandwidth may be upgraded. A new cloud environment may go live. Periodic DDoS resilience tests can therefore be carried out according to the risk level. Re-verification after major infrastructure changes is also useful. ### The Difference Between a DDoS Test and a Penetration Test Pentesting and DDoS testing measure different security risks. #### Pentest Assesses confidentiality and integrity risks intensively too. #### DDoS Test Focuses more on availability and resilience. A pentest asks: **“Is unauthorised access possible?”** A DDoS test asks: **“Can the service stay available?”** The two exercises complement one another. ### The Difference Between a DDoS Test and a Load Test Both exercises generate traffic, but their purposes differ. #### Load Test Measures whether the application can carry the expected user load. #### DDoS Test Measures security and resilience against malicious or abnormal traffic behaviour. Load testing simulates normal user behaviour. DDoS simulation assesses abuse patterns. They are therefore not the same thing. ### The Difference Between a DDoS Test and a Stress Test A **stress test** pushes the system above its capacity limits to understand at which point it breaks. In a DDoS test, not only capacity but also whether the defensive systems can distinguish and block attack traffic is measured. DDoS simulation is therefore also a security test. ### What Is the Biggest Mistake in DDoS Testing? One of the biggest mistakes is seeing the test merely as “sending load”. For example: “We sent 10 Gbps of traffic and the system stayed up.” is not enough on its own. The following must also be known: Which layer was tested? What was the PPS? What was the CPS? What was the HTTP RPS? When did anti-DDoS engage? How much resource did the firewall use? Were real users affected? Did the SOC receive an alert? Otherwise the test may not be technically meaningful. ### Why Is DDoS Resilience Testing Valuable for Management? For management the most important question is business impact rather than technical detail. A report can be summarised like this, for example: **“The critical customer portal remained available under an 8 Gbps volumetric attack, but in the layer 7 scenario the login endpoint fell outside SLA above 3,500 RPS.”** This output is clear for management. An investment decision can now be made. Areas such as; WAF tuning, backend scaling, rate limiting, anti-DDoS capacity can be prioritised. ### DDoS Simulation and Cyber Resilience **Cyber resilience** is an organisation's capacity to keep its services running when an attack occurs and to return to normal quickly. DDoS testing is a direct part of that concept. Because a DDoS attack can strain the organisation even when it fails. The real objective should be: #### To keep the service running as far as possible and limit the attack's impact rather than to prevent every packet. A DDoS simulation should therefore measure not only prevention but also; detection, response, recovery capabilities. ### Conclusion: Having DDoS Protection and Being Ready for DDoS Are Not the Same Thing An organisation may be using; anti-DDoS, a WAF, a CDN, a firewall, NDR, a SIEM. But the real question is this: #### Do all of these genuinely work together during the same attack? That answer cannot be learned from product catalogues. It must be measured under real traffic. A professional DDoS attack simulation shows; at which attack level the alert fires, at which point mitigation begins, which component forms the bottleneck, how real user experience is affected, how quickly SOC and incident response teams react. A DDoS test is therefore not merely a technical capacity measurement. **It is the controlled verification of corporate cyber resilience.** But a significant part of DDoS testing takes place at the network level. Layer 3 and layer 4 attacks in particular can directly strain critical components such as; the firewall, routers, the load balancer, the internet connection. The next step is therefore to understand network layer attacks in more detail.