DDoS Booters and IP Stressers

What is an IP stresser or DDoS booter?

An IP stresser or DDoS booter is a service that sends traffic at a target to overwhelm it. An attack can fill a network connection, exhaust server resources, or flood a website with requests. Users may see slow pages, failed logins or an outage.

These services often describe their traffic as testing. For an approved load test, the system owner agrees to the target, timing, traffic limits and stop conditions in advance. Record those details and tell the teams who monitor the service.

What should you check during an attack?

Start with the affected service and the traffic reaching it:

• Network capacity: Check bandwidth, packet rates and connection counts with your hosting or network provider.
• Application requests: Check which hostnames and routes receive the most requests. Compare request rates, response times and errors with a normal period.
• Origin load: Check CPU, connection limits and slow dependencies. Record which requests reach the application after edge controls run.
• Customer activity: Check whether people can still log in, search, use APIs and complete purchases.

Keep timestamps, affected addresses, request logs and any threat messages. Use the same time zone when comparing records from different systems.

How can the traffic affect a service?

A UDP flood can put pressure on network capacity. A TCP ACK flood can consume packet-processing resources. HTTP floods can repeatedly request pages or call expensive application routes.

The right response depends on where the traffic causes a problem. Ask your upstream provider to help with network capacity and packet floods. For HTTP traffic, inspect the requests and apply controls to the affected routes.

A short burst can still interrupt checkout or login. Record it and check for repeated bursts, changes in targets and other account activity around the same time.

How do you prepare?

List the services that matter most to customers. Record normal traffic levels, the people who can change rules and the contact details for your hosting and network providers.

For websites and APIs:

• Cache public content where the application allows it.
• Review rate limits for login, search and other costly routes.
• Check which application requests the firewall and bot controls allow or block.
• Monitor origin traffic, response times and errors while changing a rule.
• Test alerts and escalation contacts before an incident.

Peakhour's HTTP DDoS mitigation uses request rules, rate controls, caching and logs to help protect websites and APIs. Arrange upstream protection for attacks that fill network capacity.

What belongs in a response plan?

Assign someone to check the traffic, someone to approve rule changes and someone to update customers. Record each change and its effect on request volume, application health and customer activity.

After the incident, check whether alerts arrived in time, contacts responded and customers could use the service. Update route controls and response steps using what the logs show.

Related learning

• What is a DDoS attack?
• What is a Layer 7 DDoS attack?
• What is a CDN?