A botnet is the attack infrastructure behind most distributed denial-of-service events, a network of compromised hosts under one operator's control, and reproducing its effect is the purpose of a DDoS test. The operator infects devices (servers, PCs, home routers, IoT cameras) with malware, then directs the whole fleet to send traffic at a single target at once. That many-source structure is what puts the "distributed" in DDoS.
What a botnet is made of
A botnet has two parts: the bots and the channel that steers them. The bots are ordinary devices running someone else's code without their owner's knowledge. The channel is command and control, the path the operator uses to hand the fleet a target, a start time, and an attack type.
Recruitment is opportunistic. A worm scans for a known vulnerability or a default password, installs its payload, and the freshly infected host starts scanning for others. Consumer IoT is the richest ground, because the devices are numerous, always on, rarely patched, and often shipped with credentials the owner never changes. The Mirai family industrialised exactly that, assembling hundreds of thousands of cameras and routers by trying a short list of factory logins, and its leaked source spawned a long line of variants still churning through the same device pool. That specific lineage is an IoT botnet.
The control channel has evolved to survive takedown. Early botnets dialled home to a central IRC or HTTP server, a single point defenders could seize or sinkhole to decapitate the whole fleet. Newer designs push commands over peer-to-peer gossip or rotate through algorithmically generated domains, so there is no one server to pull.
The operator rarely attacks in person. Access to a fleet this size is rented by the hour through a booter or stresser service, which puts it within reach of someone with no infrastructure of their own and a small budget.
Why dispersion is the whole point
A botnet's defining property is dispersion. Traffic arrives from thousands of distinct IPs across many networks, autonomous systems, and countries, which lets an operator keep each source under the per-IP rate limits and single-source thresholds that would otherwise catch it. Each individual bot can look almost polite, a few requests a second, while the sum saturates the target.
That spread also blunts the obvious defences. Blocking by IP reputation is weak when the sources are residential addresses belonging to real subscribers, because dropping them risks dropping real customers who share the same address behind carrier NAT. Geographic filtering fails when the fleet spans every region a genuine audience comes from. The defender cannot simply cut off a range, because the attack is wearing the same clothes as the traffic it hides in.
When an attack needs a botnet, and when it does not
Not every large attack is botnet-driven, and the distinction decides what a defence is actually facing. A reflection attack borrows volume from open services rather than owned devices, so an operator with a single well-connected host can generate hundreds of gigabits without controlling anything. Volume alone therefore says nothing about whether a fleet exists behind it.
What a botnet buys is not bandwidth but legitimacy. Reflected traffic is forged and stateless: it cannot complete a handshake, cannot hold a session, and cannot request a page. A bot is a real host with a real address that can do all three, which is why application-layer attacks need one and volumetric reflection does not.
That is also why the two are defended differently. Reflected floods are filtered on protocol and source characteristics, because nothing legitimate looks like them. Botnet traffic has to be judged on behaviour, because each request is individually well-formed and indistinguishable from a real one in isolation.
Fleet size is reported more often than it is measured. Counts published after a takedown usually describe unique addresses observed over a window, which overstates the fleet wherever carrier NAT puts many subscribers behind one address and understates it wherever one subscriber cycles through several. Treat the headline number as an order of magnitude.
What a DDoS test measures about it
The lesson a botnet teaches a test is that the source model matters as much as the bit rate. A defence tuned against a single loud source collapses when the same volume arrives spread across a /16, so a test that hammers from one host proves almost nothing about how the target holds up against a real fleet.
A meaningful exercise reproduces the distribution: many source addresses, realistic per-source rates, and a traffic mix that looks like it comes from the spread of networks a genuine botnet spans, rather than one machine turned up loud. The realism of that model, not the headline gigabits, decides whether the result means anything. How the many-source structure is exercised alongside the specific attack vectors it carries is laid out in Understanding DDoS Attack Vectors.