A BlackNurse attack is a low-bandwidth attack vector, one of the attack classes a thorough DDoS test is built to exercise. It floods a firewall with ICMP Type 3 Code 3 packets, the "destination unreachable, port unreachable" message, rather than the ICMP echo requests used in an ordinary ping flood. Processing this specific message is unusually expensive on some stateful firewalls: each packet triggers a session lookup and stateful handling, so the CPU saturates at rates as low as 15 to 18 Mbps, a trickle by volumetric standards. That is what makes BlackNurse notable: it can take a firewall offline from a single home broadband connection, without the hundreds of gigabits a volumetric flood needs. The traffic profile stays small on a bandwidth graph, so a defense sized only for packet volume or raw throughput misses the attack entirely while the device behind it stops forwarding traffic.
Why it matters in DDoS testing
A BlackNurse attack breaks the assumption that a small attack is a harmless one, so a test that only ramps bandwidth will report a pass while a specific low-rate ICMP pattern still pegs the firewall. A DDoS test measures the CPU load a stream of ICMP Type 3 Code 3 packets puts on the firewall at low bit rates, and whether filtering that specific message type at the edge holds without breaking legitimate path-MTU signaling. For where this sits among the network-layer classes, see Understanding DDoS Attack Vectors.