What an ACK flood does
An ACK flood sends a high rate of TCP ACK segments that belong to no established connection. Because the ACK flag normally marks a packet as part of an ongoing conversation, a stateful firewall or connection tracker must look each one up to decide whether it matches a known flow — and every lookup misses. Unlike a SYN flood, a pure ACK flood slips past SYN-cookie defences, which only engage on connection setup, so it targets the inspection and reset-generation path instead of the backlog.
How ddos-simulation.com simulates it safely
ddos-simulation.com emits raw TCP ACK segments at a guaranteed rate from the worker's real address to a single verified domain pinned to a public address — the acknowledgement is deliberately out-of-state, but the source is never forged. The rate stays inside the limits set for that domain, health checks watch the target throughout, and the run aborts itself the moment a threshold you set is crossed.
Authorized targets onlyEvery run is bound to one verified domain you have proven you own. Ownership is checked over HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.
What the test exercises
- Stateful firewall and connection-tracking (conntrack) lookup cost on out-of-state packets
- The TCP stack's reset-generation path for unmatched ACKs
- Resilience that does not depend on SYN-cookie or SYN-backlog mitigation
- CPU and state-table headroom under control-packet pressure
- Time-to-degrade and recovery once the flood stops
When to run an ACK flood test
Run an ACK flood test when you need to prove that your defences hold against traffic that looks like it belongs to an existing session.
- You have SYN-flood mitigation in place and want to confirm it does not leave you exposed to a pure out-of-state ACK flood.
- A stateful firewall, NAT, or load balancer keeps per-flow state and you need evidence its connection-tracking table absorbs unmatched ACKs.
- You want an isolated, named vector rather than a mixed flag flood, so the result maps cleanly to one failure mode.
How to run an ACK flood test
- Verify your domain. Prove ownership over HTTPS — it is self-service and takes minutes.
- Add the
ack_flood command to a timeline in the portal and set the target port, rate, and duration. - Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
- Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
- Read the results. Review the recorded reachability, latency, and worker timeline to find where your service starts to bend.
Configure an ACK flood test in the portal →
Reading the results
Resilient: Out-of-state ACKs are dropped cheaply, connection-tracking stays within capacity, and legitimate sessions keep flowing with flat latency.
Under strain: The conntrack or firewall state table fills, softirq CPU climbs handling unmatched ACKs, or legitimate connections are evicted — signs the inspection path, not bandwidth, is the bottleneck.
Availability & limits
The ACK flood is a network-layer technique reviewed and approved before it runs (a manual review, beyond verifying you own the domain) and is priced per engagement — request a quote.
Frequently asked questions
Does this spoof source addresses like a real ACK flood?
No. Every ACK segment is emitted from the worker's own public address at a guaranteed rate — nothing is forged. The segments are deliberately out-of-state (they match no existing connection), which is what forces the stateful-inspection work, but the source is always real and attributable.
How is an ACK flood different from a SYN flood?
A SYN flood pressures the half-open connection backlog and is answered by SYN-cookie mitigation. A pure ACK flood bypasses SYN-cookie defences entirely: every ACK matches no flow, so it forces the stateful firewall and connection-tracking table into a lookup that misses on every packet, exercising a different path than a SYN flood.
Rehearse an ACK flood against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.
Build a test plan