There are several companies providing software for simulating Denial of Service (DoS) attacks. I am curious as to how realistic these simulations can be.

What are the key differences between real vs simulated attacks?


First and foremost, when simulating you know what the attack is. With a real attack, you may have to do some sleuthing to figure out what is being done. This is pretty easy with network attacks but when they start targeting applications, the diagnostics can be more challenging.

Highly Distributed Attacks are Hard to Simulate

With DDoS, the distribution of the IPs may be far broader than you can easily simulate.

This can play a significant role if you use any type of IP rate limiting tools or behavior-based detection methods.

In one case, I had an HTTP application attack that was flooding a server. We used a counter-measure to drop requests based on request rate of the IP. This worked find until the attackers broadened the attack. They started hitting with thousands of IPs at a rate below our thresholds.

Simulating this type of attack is doable but challenging. In the end, I think we had about 25,000 IP addresses attacking with a near 600Mbs flood. This was all HTTP traffic.

  • I understand that attack 'simulations' mean that you know what the attack is, so it would be less effective of an incidence response exercise for company security teams. But it's also the case that a company could simulate an attack without disclosing what type of attack it is in order to train its security team. Can you share with us the challenges of simulating a broad distribution of IPs? Also, could you please tell us other reasons as to why highly distributed attacks are hard to simulate? – user968562 Jan 4 '12 at 19:06

There isn't one - except that if you're paying for it or doing it yourself, you can make it stop immediately when your systems start to crumple.

  • Ahh. I always assumed that there are some limitations with simulated DoS attacks. So I suppose that there is absolutely nothing different besides the fact that they're deployed internally. – user968562 Jan 4 '12 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.