What is DDoS simulation testing?
A distributed-denial-of-service (DDoS) attack tries to overwhelm a service with traffic until legitimate users can no longer reach it. DDoS simulation testing reproduces that pressure on purpose, against systems you control, so you can find the breaking point on your own schedule instead of discovering it during a real incident.
Good simulation testing is bounded and observable: you know exactly what traffic is generated, you watch service health in real time, and you can stop the moment you have your answer. That is the model ddos-sim.com is built around.
How we run simulations safely
Every technique below is scoped at each layer, by design:
- Verified domains only. Ownership is proven over DNS or HTTPS before anything runs, and each worker refuses any target other than its one assigned domain.
- No spoofing, no arbitrary payloads. Traffic goes through the OS network stack to a pinned public address, with private and loopback destinations blocked.
- Per-domain limits. Rate, concurrency, and worker counts are capped per domain and scaled to its validation level.
- Automatic abort. Set error-rate, latency, or status-code thresholds and the test stops itself the instant your service crosses them.
The result is a stress test, never a weapon. See the Acceptable Use Policy for the full rules.
The nine simulations
Each page explains the real attack, how we reproduce it in-bounds, what it exercises, and how to run it.
https_check
Run an authorized HTTPS resilience test against a domain you own.
L7
HTTP load test
http_check
Simulate an HTTP request flood against infrastructure you own.
L7
Slowloris test
slowloris_check
Simulate a Slowloris slow-HTTP attack against a domain you own.
L6
SSL/TLS exhaustion test
tls_exhaustion_check
Simulate a TLS handshake flood against a domain you own to expose the CPU cost of repeated SSL/TLS negotiation and how your termination layer scales.
L7
HTTP/2 Rapid Reset test (CVE-2023-44487)
http2_rapid_reset
Test your servers against the HTTP/2 Rapid Reset attack (CVE-2023-44487).
L4
TCP port stress test
port_check
Open a controlled number of real TCP connections to a port you own and confirm how listener backlog, firewalls, and connection tracking hold up under load.
L4
SYN flood test
syn_flood_check
Simulate a SYN flood against a domain you own to pressure the TCP connection table and backlog — with full, unspoofed handshakes.
L4
UDP flood test
udp_flood
Simulate a bounded UDP flood against infrastructure you own to probe UDP ingress filtering, bandwidth headroom, and rate limits.
L3
ICMP (ping) flood test
icmp_flood
Simulate an ICMP (ping) flood against a host you own to measure resilience to network-layer noise, ICMP rate limiting, and bandwidth headroom.
Free vs. paid access
Verify a domain and the free allowance gives you three bounded HTTPS resilience tests every rolling 30 days at up to 10,000 requests per second, with no card required. Most other techniques run with prepaid credits after verification. The most aggressive network-layer methods — UDP and SYN floods — require extended validation, a manual review, and HTTP/2 Rapid Reset is a paid technique excluded from the free allowance.
Frequently asked questions
What is DDoS simulation testing?
DDoS simulation testing rehearses a real distributed-denial-of-service attack against infrastructure you own, under controlled conditions, so you can measure how it holds up and fix weaknesses before a real attacker finds them. On ddos-sim.com every run is bounded, targets a verified domain, and can abort itself the moment your service degrades.
Is DDoS simulation testing legal?
It is legal when you test systems you own or are clearly authorized in writing to test. ddos-sim.com enforces this with domain-ownership verification and per-domain limits, and never runs traffic against arbitrary targets. Testing systems you do not own or control may be a criminal offence.
How many attack techniques can I simulate?
Nine, spanning Layers 3 to 7: HTTP check, HTTPS check, port check, UDP flood, SYN flood, Slowloris, ICMP flood, SSL/TLS exhaustion, and HTTP/2 Rapid Reset (CVE-2023-44487).
Do I need to pay to start?
No. After you verify a domain, the free allowance gives you three bounded HTTPS resilience tests every rolling 30 days at up to 10,000 requests per second, with no card required. Prepaid credits unlock higher throughput and the more aggressive techniques.
Draft a timeline in the browser now — no account needed — then verify a domain when you are ready to run it.
Configure a test