Bits per second (BPS) is usually described as the size of a DDoS attack: the Gbps or Tbps figure in every incident headline. That holds only for the link the flood has to cross, and a DDoS test exists to find out whether that link is what fails first or whether something smaller gives way at a fraction of the bandwidth.
BPS counts the data crossing a link each second. It is the unit that defines a volumetric attack, where the goal is simply to fill the pipe so legitimate packets are dropped at the congested hop before they reach the origin. One well-documented example, the memcached reflection flood against GitHub in February 2018, peaked at 1.35 Tbps, and the largest reported floods have grown several times past that since.
Why the full link is never yours to fix
A link has a hard ceiling, and the one that matters is the smallest in the path: usually a transit port, a cross-connect or the provider's handoff, not the server's network card. When it fills, the loss happens upstream of every device you operate. Your firewall logs look quiet because the traffic it would have logged never arrived.
So nothing you run can drop the excess. The filtering has to happen somewhere with more capacity than the flood, which is why bandwidth is the figure quoted on transit commitments and on scrubbing center contracts.
Why the graph understates it
Two measurement habits make BPS look smaller than it was.
The first is averaging. Most link graphs come from SNMP counters polled every five minutes, and bandwidth billing uses the same samples. A 60-second burst at 40 Gbps on an otherwise idle port averages to 8 Gbps on that graph, and a pulse attack that saturates for seconds at a time can look like a moderate busy hour.
The second is what the counter counts. Interface byte counters record frames, not the 20 bytes of preamble and inter-frame gap each frame also occupies on the wire. For large frames the gap is negligible. For a 64-byte flood at line rate it is nearly a quarter of the wire, so a 10 Gbps port that is completely full reports about 7.6 Gbps. At that size the device usually runs out of packets per second budget before it runs out of bits anyway.
What a DDoS test measures about it
A test ramps volume in steps and records, at each hop, the rate at which loss begins and at which latency for legitimate probes starts to climb. Latency usually moves first, as buffers fill before the link reads 100%.
It samples at one second or finer rather than trusting five-minute averages, and it compares the rate it sent with what each counter reported, so the gap between the two is known before an incident. The result it needs is the margin: how far below the smallest link's ceiling the traffic is diverted to upstream filtering. Sending that volume over real transit is only done with the provider's agreement, which is part of the test plan rather than an afterthought.
Where bits per second sits among the rate units that size the other attack classes is laid out in understanding DDoS attack vectors.