Commercial vs. Open-Source DDoS Testing
Today, multiple open-source tools can be used to run a DDoS test. This raises the question: Can those tools can be used to replace commercial DDoS testing, thereby reducing the test cost?
Open-source tools include tools like ‘hping’, ‘ab (Apache Benchmark)’, Cisco’s ‘TRex’ and other tools that can be classified as packet generators, traffic generators and DDoS tools. Most of the popular tools are not designed for DDoS but do have DDoS functionality, like the ‘—flood’ option in hping.
To understand the difference between open-source and commercial services, let’s first examine the difference in the DDoS testing process.
DDoS testing process
Full DDoS testing is a process with three parts: planning, test execution and summary. Here are the differences in the process when you use an open-source service as compared to a commercial service.
| Phase | Description | Open-Source DIY | Commercial DDoS Services |
|---|---|---|---|
| PLANNING | During this phase, the DDoS service provider and the customer go over the network and service structure, assemble technical details, and define clear goals and the exact schedule of the test. |
|
|
| CONTROLLED DDOS ATTACKS | In this phase, the DDoS attack is executed per the plan. |
|
|
| SUMMARY & RECOMMENDATION | The summary phrase includes a written report and, typically, a summary meeting. The report includes a test summary, analysis and recommendations. |
|
| Phase | Description | Open-Source DIY | Commercial DDoS Services |
|---|---|---|---|
| PLANNING | During this phase, the DDoS service provider and the customer go over the network and service structure, assemble technical details, and define clear goals and the exact schedule of the test. |
|
|
| CONTROLLED DDOS ATTACKS | In this phase, the DDoS attack is executed per the plan. |
|
|
| SUMMARY & RECOMMENDATION | The summary phrase includes a written report and, typically, a summary meeting. The report includes a test summary, analysis and recommendations. |
|
Real-life Simulation
The other interesting comparison between open-source and commercial DDoS testing is how close the attack is to the real, malicious attack.
The goal of a DDoS attack is to create “the real thing” – an attack that is as close as possible to a real DDoS attack (but, of course, one that can be controlled and stopped at any time).
This table shows the difference between open-source and commercial attacks.
| Category | Open-Source | Commercial |
|---|---|---|
| Attack Vectors | Open-source tools typically have only a small portion of DDoS attacks. |
Most DDoS testing vendors have dozens and hundreds of attack vectors covering most of the DDoS spectrum. |
| Number of Bots | One, few or multiple bots in a single physical server. | Commercial DDoS testing can include dozens, hundreds and even thousands of bots. |
| Geographical distribution | Typically running from a single location. |
Like real DDoS botnets, the bots are spread all over the world in various geographical locations. |
| Category | Open-Source | Commercial |
|---|---|---|
| Attack Vectors | Open-source tools typically have only a small portion of DDoS attacks. |
Most DDoS testing vendors have dozens and hundreds of attack vectors covering most of the DDoS spectrum. |
| Number of Bots | One, few or multiple bots in a single physical server. | Commercial DDoS testing can include dozens, hundreds and even thousands of bots. |
| Geographical distribution | Typically running from a single location. |
Like real DDoS botnets, the bots are spread all over the world in various geographical locations. |
Summary
Open-source DDoS testing can be useful in some scenarios. It maintains the advantages of being free and able to be used at will.
However, when using open-source tools for DDoS testing, you must keep in mind that the generated attack is not realistic and that you must base it on your own DDoS expertise, rather than rely on experts to guide you through the entire process.
| • Test is a lab environment. • Test can be repeated again and again. • Testing is required for very specific, well-defined validation. |
• Testing production • Test windows are very small and cannot be repeated again and again • POC • The planning and summary are critical to the test and require DDoS expertise • Test must simulate real-life DDoS attacks |
| • Test is a lab environment. • Test can be repeated again and again. • Testing is required for very specific, well-defined validation. |
• Testing production • Test windows are very small and cannot be repeated again and again • POC • The planning and summary are critical to the test and require DDoS expertise • Test must simulate real-life DDoS attacks |