DISTRIBUTED DENIAL OF SERVICE (DDoS)
See how excessive traffic affects server availability.
Simulation Controls
Simulated time 0:00Traffic Flow to the Target Server
Normal traffic is within capacity. Every legitimate request is being processed.
Defense Layers
StandbyCaps how many requests each source may send, so a single noisy source cannot use up the server.
Rejects requests that match known bad patterns, such as malformed or suspicious traffic.
Spreads traffic across more server instances. It blocks nothing, but raises total capacity.
Absorbs and cleans traffic upstream, before it ever reaches the organization's own network.
Defenses are off. All traffic reaches the server directly.
Statistics Dashboard
Totals since last resetReal-Time Traffic (requests per second, last 60 seconds)
View chart data as a table
| Time ago | Incoming (req/s) | Capacity (req/s) | Processed (req/s) |
|---|
Simulation Event Log
Educational Deep Dive: Denial of Service
University Cybersecurity CurriculumWhat is DDoS?
A Distributed Denial of Service (DDoS) attack tries to make a service unavailable by overwhelming it with more traffic than it can handle. The traffic comes from many systems at once, often compromised devices organized into a botnet. Nothing has to be stolen or broken into: the goal is simply to stop real users from getting through.
Difference between DoS and DDoS
| DoS | DDoS | |
|---|---|---|
| Traffic origin | One source | Many sources at once |
| Typical volume | Limited by one machine and its connection | Combined volume of every source |
| Blocking the source | Often enough to stop it | Hard, because sources are numerous and can resemble real users |
How excessive traffic affects server resources
Every request uses a little of a server's finite resources, and a flood can exhaust any of them:
- Network bandwidth: the connection fills up before requests even reach the server.
- CPU and memory: time spent on junk requests is unavailable for real work.
- Connection tables: the limit on open connections is reached, so new ones are refused.
- Queues: waiting requests pile up, response times climb, and once the queue is full new requests are dropped.
- Crashes: if the overload lasts long enough, the server or its software can fail outright. Then nobody gets served until it restarts, and restarting into the same flood would just bring it down again.
The simulation shows this directly. When incoming traffic passes capacity, the queue fills, response time rises, and the processed line falls below capacity because an overloaded server spends effort just managing its backlog.
Why legitimate users experience service disruption
A server usually cannot tell which requests deserve priority, so real users compete with the flood for the same capacity. If 95% of incoming requests are junk, a real user's request is one small part of the pile. They see slow pages, timeouts and error messages even though they did nothing wrong and their own connection is fine. Watch the Legitimate Success Rate readout drop during the simulation.
How organizations defend against DDoS
- Rate limiting: restricts how many requests a single source can make in a time window.
- Traffic filtering: drops traffic matching malicious patterns, using firewalls and web application firewalls.
- Load balancing and scaling: spreads requests across more servers to raise capacity.
- DDoS protection services and CDNs: absorb and clean traffic on large networks before it reaches the origin server.
- Planning: monitoring for unusual traffic, plus a tested incident response plan.