Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be.

What are the key differences between real vs simulated attacks?

share|improve this question

First and foremost, when simulating you know what the attack is. With a real attack, you may have to do some sleuthing to figure out what is being done. This is pretty easy with network attacks but when they start targeting applications, the diagnostics can be more challenging.

Highly Distributed Attacks are Hard to Simulate

With DDoS, the distribution of the IPs may be far broader than you can easily simulate.

This can play a significant role if you use any type of IP rate limiting tools or behavior-based detection methods.

In one case, I had an HTTP application attack that was flooding a server. We used a counter-measure to drop requests based on request rate of the IP. This worked find until the attackers broadened the attack. They started hitting with thousands of IPs at a rate below our thresholds.

Simulating this type of attack is doable but challenging. In the end, I think we had about 25,000 IP addresses attacking with a near 600Mbs flood. This was all HTTP traffic.

share|improve this answer
I understand that attack 'simulations' mean that you know what the attack is, so it would be less effective of an incidence response exercise for company security teams. But it's also the case that a company could simulate an attack without disclosing what type of attack it is in order to train its security team. Can you share with us the challenges of simulating a broad distribution of IPs? Also, could you please tell us other reasons as to why highly distributed attacks are hard to simulate? – user968562 Jan 4 '12 at 19:06

There isn't one - except that if you're paying for it or doing it yourself, you can make it stop immediately when your systems start to crumple.

share|improve this answer
Ahh. I always assumed that there are some limitations with simulated DoS attacks. So I suppose that there is absolutely nothing different besides the fact that they're deployed internally. – user968562 Jan 4 '12 at 18:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.