Every method below is a controlled network stress vector that simulates a real-world attack pattern. Each entry explains what the method does, which layer of the OSI stack it targets, what kind of resource exhaustion it causes on the victim, its typical amplification factor, and the recommended detection signature. Use this catalog to choose the right vector for the failure mode you are trying to reproduce.
Layer 4 methods target the network and transport layers of the OSI model. They aim to saturate bandwidth, exhaust connection state in firewalls and load balancers, fill NAT tables, or consume packet-processing CPU on the target's edge router. These vectors do not need to understand the application running on the target — they only need packets to reach it. Bandwidth-driven and state-driven, Layer 4 floods are the classical "volumetric" attack pattern.
A UDP flood sends large numbers of User Datagram Protocol packets to random ports on the target. For each packet, the victim's kernel must determine whether any application is listening on the destination port; when none is, it generates and sends back an ICMP "destination unreachable" packet. This forces the target to spend CPU on port lookups and outbound bandwidth on ICMP responses, which compounds as the flood grows. UDP is connectionless, so attackers can spoof source addresses and send at line rate without any handshake overhead. UDP floods are the simplest volumetric vector and remain the most common Layer 4 attack observed in the wild.
A TCP SYN flood exploits the three-way handshake that initiates every TCP connection. The attacker sends a barrage of SYN packets but never completes the handshake with the final ACK. The target allocates a half-open connection record for each SYN and waits for an ACK that never arrives, gradually filling its connection table. Once the table is full, the target can no longer accept new legitimate connections, even though its bandwidth and CPU may be largely unused. SYN floods are extremely effective against stateful firewalls, load balancers and any service that pre-allocates resources per connection. SYN cookies, while widely deployed, only mitigate the symptoms — they do not stop the flood from consuming inbound bandwidth.
A TCP ACK flood sends ACK packets that acknowledge data the target never sent, i.e. for connections that do not exist in the target's state table. The target must walk its connection table to determine whether the ACK belongs to a known session; when it does not, the kernel generates and sends an RST. This state-table lookup is expensive on stateful firewalls, and the resulting RST traffic can saturate uplink bandwidth. ACK floods are particularly effective against next-generation firewalls that perform deep packet inspection, because every packet must be evaluated against the full connection tracker. Because ACK packets look like benign TCP traffic, simple ACL filtering rarely stops them.
An ICMP flood sends massive numbers of ICMP Echo Request (ping) packets to the target, forcing it to generate Echo Replies for each one. The classic "smurf" amplification variant directs the pings at a broadcast address with the victim's address spoofed as the source, multiplying the response traffic by the number of hosts on the segment. Modern ICMP floods are usually direct, but they remain effective against poorly rate-limited edge devices and against hosts that process ICMP in the kernel slow path. Many cloud providers now rate-limit ICMP at the hypervisor, which has reduced the real-world impact of pure ICMP floods, but they are still useful in mixed-vector scenarios for adding inbound packet pressure.
TCP-GREEDY opens and holds large numbers of legitimate TCP connections, completing the three-way handshake and then keeping each socket alive with minimal traffic. Unlike a SYN flood, the connections are fully established and look completely normal to the target's connection tracker. The victim's TCP stack, application server and any per-connection middleware (TLS terminators, proxy pools, database connection pools) each allocate resources for every connection until they hit configured limits. Once the connection limit is reached, new legitimate users cannot connect. TCP-GREEDY is especially effective against services with per-connection session state and is the Layer 4 precursor to a Layer 7 SLOWLORIS attack.
Amplification attacks abuse legitimate third-party services that respond with much more data than they receive. The attacker sends a small request with the victim's address spoofed as the source; the third-party service sends its large response to the victim. The amplification factor is the ratio of response bytes to request bytes. The largest documented amplification factor was Memcached at 51,000× — a 1 Mbps spoofed request stream producing 51 Gbps of victim-bound traffic. Stressthem supports the following amplification vectors against pre-authorized targets in jurisdictions where source spoofing is permitted on the test path.
Abuses the monlist command of older Network Time Protocol daemons, which returns the list of the last 600 hosts that interacted with the server. A single 8-byte request can trigger a 4,460-byte response, yielding a 556× amplification factor. Effective against unpatched NTP servers; modern ntpd versions disable monlist by default.
Abuses open DNS resolvers that support EDNS0 large responses. The attacker sends a 60-byte query for a TXT or ANY record of a DNSSEC-signed zone, spoofing the victim's address; the resolver sends back a 3,000–4,000 byte response. DNS amplification is the most common reflection vector in the wild because open resolvers remain abundant.
Abuses the Simple Service Discovery Protocol used by UPnP on consumer routers and IoT devices. A M-SEARCH query for "ssdp:all" causes exposed devices to send back unsolicited UPnP announcements. Modest amplification factor but huge pool of reflectors — millions of home devices are still exposed.
Abuses Connectionless LDAP (UDP port 389) exposed on misconfigured Active Directory domain controllers. A small anonymous root DSE query produces a large response containing the directory schema. CLDAP reflection is heavily used against gaming and gambling targets because of its high packet-per-second density.
The largest amplification vector ever observed. A 15-byte UDP request to an exposed Memcached server can return a cached value up to 1 MB, yielding up to 51,000× amplification. Responsible for the 1.35 Tbps GitHub attack of February 2018. Modern Memcached disables UDP by default; only legacy deployments remain vulnerable.
Abuses Remote Desktop Protocol (UDP 3389) endpoints that respond to connection pre-grout requests with large RDP negotiation responses. A single 4-byte request can trigger a 340-byte response. Used heavily against financial-sector targets in 2020 and 2021, before Microsoft patched the affected RDP implementations.
Layer 7 methods target the application itself, mimicking legitimate HTTP or HTTPS requests in order to exhaust server-side resources that bandwidth-focused Layer 4 floods cannot reach. They consume PHP-FPM workers, Java thread pools, Node.js event loop capacity, database connection pools, session storage and cache backends. Layer 7 vectors require very little bandwidth — often less than 50 Mbps — but they can take a service completely offline by exhausting the worker pool that handles real users. They are also harder to detect because the traffic looks superficially identical to legitimate user requests.
An HTTP GET flood sends massive numbers of HTTP GET requests to the target web server, typically aimed at expensive endpoints such as search, product pages, dynamic filters or any URL that triggers a database query. Each request forces the server to execute application code, render a template and return a response. Unlike a SYN flood, GET floods complete the full TCP + TLS + HTTP cycle, so they consume worker threads for the entire round-trip time. A single attacker can produce thousands of requests per second because each request is small and inexpensive to send. GET floods are particularly damaging against CMS-driven sites (WordPress, Drupal, Magento) where every page miss triggers database queries and cache rebuilds.
An HTTP POST flood sends POST requests with large bodies to upload endpoints, form processors or API endpoints that accept JSON/XML payloads. The server must buffer and parse the body before validation, which consumes memory and CPU on every request. POST floods are more expensive for the victim per request than GET floods, because body parsing and validation happen before the application can respond. Targeting file-upload endpoints compounds the impact: each request may trigger virus scanning, image resizing, object storage uploads and database writes. A modest POST flood can saturate a server's inbound bandwidth while simultaneously exhausting upload-handler worker pools.
An HTTP HEAD flood uses HEAD requests instead of GET. The server is required to compute the response headers exactly as it would for a GET (including any Content-Length that would require database access to determine), but it does not send the body. This means the application does the same expensive work as a GET flood, but the attacker saves inbound bandwidth by not downloading bodies. HEAD floods achieve higher request rates than GET floods on the same target because they consume less network I/O on the attacker side. They are particularly effective against frameworks that route HEAD requests through the full controller stack rather than short-circuiting early.
SLOWLORIS opens many HTTP connections and sends a partial request, then periodically sends additional HTTP headers to keep each connection alive without ever completing the request. Because the request is incomplete, the web server cannot process it and must hold the connection open waiting for more data. Apache, nginx-with-cgi and many other servers will keep these connections alive for the configured timeout (often 30–120 seconds), at which point SLOWLORIS simply sends another header to extend the wait. A single attacker machine can exhaust Apache's MaxRequestWorkers limit with around 400 connections, taking the entire site offline with negligible bandwidth. SLOWLORIS is the canonical example of a low-and-slow Layer 7 attack.
SLOWPOST (sometimes called "slow body" or R-U-Dead-Yet) sends a complete HTTP request with a Content-Length header indicating a large body, but then dribbles the body out one byte per second. The server is required by HTTP to wait until the full body is received before processing the request, so it allocates a worker and a buffer for the duration. A handful of slow-body connections can saturate the entire worker pool of a typical web server, because each one occupies a worker for minutes. SLOWPOST bypasses most rate-based defenses because the per-connection request rate is technically one request — the attack is on the body, not the request count.
The HTTP Range header attack sends requests with hundreds or thousands of overlapping byte-range specifications on the same large file. The server is required to compute and assemble each requested range into a multipart/byteranges response, which is a CPU-intensive operation. A single request can require several seconds of CPU time on unpatched Apache and IIS servers. This is one of the most efficient Layer 7 vectors in terms of CPU damage per byte of attacker traffic. Range-header attacks are also extremely hard to filter, because Range is a legitimate HTTP feature used by media players and download accelerators.
Cache-bypass floods append a unique, randomized query string to every request so that
each URL is treated as a cache miss by the CDN or reverse proxy in front of the origin.
Requests like /?cb=8a3f..., /?cb=91b2... all reach the origin
server, defeating edge caching entirely. The result is that the origin server and its
database bear the full load of the flood, even though a CDN is in place. This vector
is extremely effective against CDNs that use query-string normalization naively and
is the standard technique used to attack sites behind Cloudflare, Fastly and Akamai.
The BROWSER vector uses a pool of headless Chromium instances to send requests that are indistinguishable from real user traffic: full TLS fingerprint, real User-Agent, accepted cookies, executed JavaScript, fetched sub-resources. Because each request comes from a real browser engine, it passes JS challenges, CAPTCHA pre-checks and behavioral bot detection. BROWSER floods are the most expensive Layer 7 vector to launch — headless browsers cost CPU and memory per instance — but they are also the hardest to stop. They are the only reliable way to test services that rely entirely on client-side bot detection. Low rps is offset by the fact that each request triggers a full page render on the victim.
The XML-RPC vector abuses WordPress's built-in pingback feature to turn every
WordPress site on the internet into a reflector. The attacker sends a pingback
request to /xmlrpc.php on thousands of WordPress sites, with the
victim's URL as the source. Each WordPress site then makes an HTTP request to the
victim to "verify" the pingback. This creates a distributed Layer 7 flood where the
traffic comes from many legitimate web server IPs, making IP-based blocking
impossible. XML-RPC pingback amplification has been used in numerous large-scale
attacks against news sites and gaming platforms.
CF-BYPASS attempts to discover and flood the origin server behind a CDN such as Cloudflare, Akamai, Fastly or AWS CloudFront. It does so by enumerating subdomains, checking certificate transparency logs, scanning for direct IP access, and testing common origin-leak patterns. Once the origin IP is found, traffic is sent directly to the origin, bypassing CDN-side rate limiting and WAF rules. This is the most effective technique for testing whether your origin is properly hidden behind its CDN — if a CF-BYPASS test succeeds, it means your origin is reachable and the CDN is providing no protection.
