When a flood is spread thin enough across an entire address range, no single host ever crosses the threshold that would raise an alarm, yet the shared uplink in front of them all fills anyway. That is a carpet bombing attack, and reproducing it is one of the evasive cases a thorough DDoS test has to cover. Also called a spread-spectrum or spray attack, it is built to defeat defenses that watch one victim at a time.
How carpet bombing spreads the load
At heart this is a volumetric attack: the goal is still to deliver more traffic than a circuit can carry until clean packets are dropped at the hop that fills first. What is specific to carpet bombing is the geometry. Instead of aiming the whole flood at one destination, the attacker divides it across every address in a target's prefix, a full /24, a /22, or something larger.
Each individual host receives only a small share, comfortably below the rate any per-destination counter would flag. The prefix as a whole, and the router or transit circuit that serves it, absorbs the entire aggregate. The victim is the network segment, not any one machine on it.
That geometry is chosen for exactly one reason: most detection samples per address. NetFlow and sFlow thresholds, per-IP rate limits, and the triggers that fire on-demand mitigation all watch individual destinations. Carpet bombing is engineered so no destination stands out, so the signal those systems look for never appears even while the pipe is saturated.
Security vendors began cataloguing the pattern as a distinct technique around 2018, when campaigns against hosting providers and ISPs sprayed floods across whole customer prefixes rather than a single tenant. Because the traffic is diffuse, the carrying network often registers congestion before it can point at a victim at all.
Why it matters under attack
The trouble is one of scope. A defense pointed at a single victim IP has nothing to catch, because no victim IP is above its line. The attack only exists as a signal when you sum traffic across the whole prefix, so detection has to aggregate at CIDR granularity or it is blind to the thing happening in front of it.
The blunt fallback then backfires. Reach for RTBH to null-route the target and you discover there are hundreds of targets: black-holing the whole /24 drops every legitimate host in it at once, so the mitigation becomes the outage across the entire segment. Finer, flow-aware tools like BGP Flowspec exist precisely because a per-address response cannot answer a per-prefix attack. The aggregate itself is still counted in bits per second; what changed is where you have to measure it.
What a DDoS test measures
A carpet bombing test characterizes whether detection aggregates across a prefix rather than per host, and how fast subnet-level or flow-based mitigation engages once the diffuse pattern starts. The honest result is the aggregate rate at which the prefix-level trigger fires, not a per-IP number, because a per-IP number never moves.
It also checks the cost of the only response many networks have. If the sole available control is a CIDR blackhole, the test records the collateral: how many legitimate addresses go dark to stop the flood. Where carpet bombing sits among the flooding vectors it is routinely mistaken for is laid out in Understanding DDoS Attack Vectors.