The Complete Stresser Reference

What Is a Stresser?

A stresser — also called an IP stresser or booter — is a network traffic generation tool that floods a target IP address with high-volume packets to test how the target's infrastructure handles extreme load. The core function is identical whether the operator is a security engineer running a DDoS simulation drill or an attacker trying to knock a server offline: the stresser sends more traffic than the target can absorb.

In practice, the same mechanism that a network engineer uses to benchmark a server is identical to the mechanism an attacker uses to knock one offline. This dual-use nature makes stressers one of the most legally and technically complex categories of software in cybersecurity.

A stresser typically exposes a simple interface: enter a target IP, choose an attack vector (UDP, TCP, HTTP…), set a duration, and click. Behind the interface, the service routes traffic from a network of servers — sometimes boosted through amplification reflectors — at the target. Throughput is measured in Gbps (gigabits per second) for volumetric attacks or RPS (requests per second) for application-layer attacks.

How IP Stressers Work

An IP stresser works by routing massive amounts of network traffic through a distributed set of servers toward a single target. The attacker controls volume, protocol, and duration through a dashboard; the stresser network executes the job. Three components make this possible: traffic sources, a command layer, and spoofing or amplification to multiply output.

Most stresser services are built on a three-tier architecture: a frontend (the web dashboard the customer sees), a backend API that dispatches jobs, and a stresser network — a set of servers that actually transmit the traffic.

1. Traffic sources

A stresser needs bandwidth to send. Sources include: dedicated servers with high-bandwidth ports leased from hosting providers; compromised machines (botnets) acting as involuntary agents; open DNS/NTP/SSDP reflectors that amplify traffic for free; and cloud VMs with spoofed or rotating source IPs to defeat simple IP-based filters.

2. Spoofing and amplification

For volumetric attacks, operators spoof the source IP in UDP packets, setting it to the victim's address. Reflection servers see a request "from" the victim and send their (much larger) response to the victim. This is the core of amplification: DNS has an amplification factor of ~28×, NTP up to 556×, memcached up to 51,000×.

3. Command and control

Jobs are queued through a backend, often with rate limits per customer tier. Each attacking node receives instructions: target_ip, port, method, duration. The node generates packets at maximum line rate until the job ends or a kill signal arrives.

4. Bypassing defenses

Sophisticated stressers implement evasion: randomizing source ports, rotating payload patterns to defeat signature-based filters, fragmenting packets, embedding GET/POST requests with valid headers to evade L7 WAFs, and varying packet sizes to defeat fixed-threshold rate limiters.

Types of Stresser Attacks

Stresser attacks fall into three categories: volumetric (saturate bandwidth), protocol (exhaust state tables), and application-layer (overwhelm application logic). Each requires different mitigation. The table below covers every major method used by modern stresser services.

UDP Flood

The simplest volumetric attack. The attacker sends a high volume of UDP datagrams to random ports on the target. The target attempts to process each datagram; finding no application listening on that port, it replies with ICMP Destination Unreachable. At scale this exhausts both inbound and outbound bandwidth.

TCP SYN Flood

Exploits the three-way TCP handshake. The attacker sends SYN packets with a spoofed source IP, causing the server to allocate state for each "half-open" connection and wait for an ACK that never arrives. The server's connection table fills up and it refuses legitimate connections. SYN cookies are the standard mitigation.

HTTP/HTTPS Flood

Sends valid HTTP GET or POST requests at extreme rates. Because requests look legitimate, they bypass volumetric scrubbers. HTTPS floods are harder to mitigate because the CDN or scrubber must terminate TLS to inspect the request, adding CPU cost on the defender's side.

Slowloris

Sends partial HTTP requests, holding connections open indefinitely by periodically sending additional headers. A single machine can exhaust a web server's connection limit with very little bandwidth. Mitigated by connection timeouts and limiting concurrent connections per source IP.

Layer 4 vs Layer 7 Attacks

Layer 4 attacks saturate bandwidth and exhaust transport-layer state tables using raw packets. Layer 7 attacks send valid application requests to exhaust CPU and application logic — at a fraction of the bandwidth. Defending against each requires completely different technology, which is why multi-vector attacks combining both layers are so difficult to stop.

Many modern stresser services offer both modes. A multi-vector attack combines L4 volumetric (to saturate pipes) with L7 (to slip through scrubbers that only filter volumetric traffic). These are significantly harder to defend against because each layer requires different mitigation logic.

Amplification Attacks Explained

An amplification attack exploits protocols that respond to a small spoofed UDP request with a much larger reply — multiplying the attacker's bandwidth by factors of 30× to 51,000× without requiring a botnet or expensive servers. The victim receives the amplified traffic; the attacker spends almost nothing.

The mechanics

The attacker crafts a UDP request with the source IP set to the victim's IP. They send this to thousands of publicly accessible servers running DNS, NTP, memcached, SSDP, or similar services. Each server sends its (large) response to the victim. The attacker consumed maybe 1 Gbps of outbound bandwidth; the victim receives 50–500 Gbps of inbound traffic.

Amplification factors

Booter vs Stresser — What's the Difference?

Technically there is no difference: both terms describe a service that sends high-volume traffic to an IP address. The distinction is cultural and legal, not technical — and courts have treated them identically under computer crime statutes in every jurisdiction where cases have been prosecuted.

Stresser is the legitimate term used in network engineering. Products like LOIC, ApacheBench, wrk, and commercial services like KEYSIGHT IxLoad are stressers used by professionals with written authorisation.

Booter emerged in gaming communities around 2010–2012 to describe services sold specifically to kick opponents offline. The word "boot" means to disconnect someone from a game or VoIP call. Booter services openly marketed themselves in underground forums and charged per-attack or monthly subscription fees.

Key Metrics: Gbps, Mpps, RPS

Stresser advertisements are filled with technical claims. Understanding what the numbers mean is essential for both engineers evaluating a legitimate testing service and defenders planning mitigation capacity.

Gbps — Gigabits per Second

The raw bandwidth delivered to the target. 1 Gbps = ~125 MB/s. Most residential and small business connections cap out at 100–1,000 Mbps. A 10+ Gbps attack will typically saturate the target's uplink even if their servers can handle the packet rate. Large hosting providers and CDN networks absorb attacks measured in Tbps (terabits per second).

Mpps — Megapackets per Second (or pps)

Packets per second measures the packet-processing burden, independent of packet size. A flood of tiny 64-byte UDP packets at 100 Mpps demands enormous CPU effort from routers and firewalls even if the total bandwidth is modest. Purpose-built network hardware can forward at line rate; general-purpose servers often cannot.

RPS / QPS — Requests per Second

Used for L7 attacks. Measures how many HTTP/HTTPS requests reach the application tier per second. A server handling 10,000 legitimate RPS might buckle under 500,000 malicious RPS even from a few hundred Mbps of traffic, because each request executes application logic, database queries, or TLS handshakes.

Duration

Attacks are typically sold in tiers: 30 seconds, 60 seconds, 5 minutes, 1 hour. Longer attacks are more expensive. Defense solutions are evaluated on time-to-mitigate (TTM) — how quickly they can detect and divert the attack. Sub-30-second TTM neutralises the vast majority of commercial stresser offerings.

How to Defend Against Stressers

No single defense defeats all stresser vectors. A layered strategy is required: scrubbing for volumetric L4 attacks, challenge pages for L7 floods, and BGP blackholing as a last resort. The cards below cover the six primary defenses used by organizations of every size.

Legal Status by Country

Using a stresser against infrastructure you own or have explicit written permission to test is legal in most jurisdictions. Using one against any third-party target is a criminal offence everywhere — the table below lists the specific statutes and maximum penalties by country.

Brief History of Network Stress Testing

1990s: Early network stress tools like LOIC (Low Orbit Ion Cannon)'s predecessors were simple flood utilities used by researchers to test routers and firewalls in lab environments.

2000s: With widespread broadband adoption, botnets became the dominant mechanism for large-scale DDoS. Groups like Anonymous popularised LOIC for politically-motivated attacks. NTP and DNS amplification were documented by security researchers.

2010–2013: Commercial booter services emerged targeting the gaming community. Services like Asylum Stresser, Lizard Squad's LizardStresser, and vDOS launched subscription-based DDoS-for-hire, making terabit-class attacks accessible for $5–$20/month.

2014–2016: Record-breaking NTP amplification attacks (300–400 Gbps). Law enforcement began active pursuit — UK's NCA and FBI arrested booter operators. vDOS taken down, operators prosecuted.

2017–2019: Memcached amplification (51,000× factor) enabled a 1.7 Tbps attack against GitHub in 2018 — the largest ever recorded at the time. Cloudflare and Akamai invested heavily in anycast scrubbing infrastructure.

2020–present: Attack sizes reached 3.47 Tbps (Azure, 2021). Multi-vector attacks combining L3/L4/L7 vectors became standard. Operation Power Off (Europol + FBI) seized over 50 booter domains. Academic research on QUIC-based amplification and TP amplification opened new vectors.

Frequently Asked Questions

Explore More Topics