What a PSH-ACK flood does
A PSH-ACK flood sends a high rate of TCP segments that carry both the PSH (push) and ACK flags together with a payload — the exact shape of a data-bearing packet in an established connection, and what most real-world attacks labelled "ACK floods" actually look like. Because each segment presents as live data for a flow the target has no record of, the stack must do more than drop a header: it has to locate the (nonexistent) connection and decide what to do with the pushed bytes, while the payload itself consumes bandwidth. That combined receive-path and inspection cost is what pressures the service.
How ddos-simulation.com simulates it safely
ddos-simulation.com emits raw TCP PSH-ACK segments at a guaranteed rate from the worker's real address to a single verified domain pinned to a public address — the segments carry crafted data and are deliberately out-of-state, but the source is never forged. The rate stays inside the limits set for that domain, health checks watch the target throughout, and the run aborts itself the moment a threshold you set is crossed.
Authorized targets onlyEvery run is bound to one verified domain you have proven you own. Ownership is checked over HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.
What the test exercises
- The receive and data-handling path for segments that look like established-flow data
- Stateful firewall and connection-tracking (conntrack) lookups on unmatched data segments
- Bandwidth headroom from payload-bearing packets, not bare headers
- CPU and state-table headroom under data-segment pressure
- Time-to-degrade and recovery once the flood stops
When to run a PSH-ACK flood test
Run a PSH-ACK flood test when you want to reproduce the data-bearing flood that real botnets send, rather than a header-only control flood.
- Your mitigation distinguishes between bare control packets and data segments, and you need to confirm it handles out-of-state PSH-ACK data.
- You want to combine inspection cost with some bandwidth pressure in a single, realistic vector.
- You need an isolated, named result for the PSH-ACK shape rather than its diluted share of a mixed flag flood.
How to run a PSH-ACK flood test
- Verify your domain. Prove ownership over HTTPS — it is self-service and takes minutes.
- Add the
psh_ack_flood command to a timeline in the portal and set the target port, rate, and duration. - Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
- Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
- Read the results. Review the recorded reachability, latency, and worker timeline to find where your service starts to bend.
Configure a PSH-ACK flood test in the portal →
Reading the results
Resilient: Out-of-state data segments are dropped cheaply, connection-tracking stays within capacity, and legitimate sessions keep flowing with flat latency.
Under strain: The conntrack or firewall state table fills, CPU climbs on the receive path, ingress bandwidth saturates, or legitimate connections degrade — signs the data path, not just the backlog, is the bottleneck.
Availability & limits
The PSH-ACK flood is a network-layer technique reviewed and approved before it runs (a manual review, beyond verifying you own the domain) and is priced per engagement — request a quote.
Frequently asked questions
How is a PSH-ACK flood different from an ACK flood?
An ACK flood sends bare, header-only acknowledgements. A PSH-ACK flood sets the PSH flag and carries a payload, so each segment looks like data from an established connection — the shape most real-world "ACK floods" actually take. That makes the target's stack do data-segment work (locate the flow and handle the pushed bytes) rather than simply dropping a header, and the payload adds bandwidth.
Does this spoof source addresses?
No. Every PSH-ACK segment is emitted from the worker's own public address. The segments are deliberately out-of-state and carry crafted data, but the source is never forged.
Rehearse a PSH-ACK flood against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.
Build a test plan