All DDoS Definitions
DDoS Testing Definition

Carpet Bombing

When a flood is spread thin enough across an entire address range, no single host ever crosses the threshold that would raise an alarm, yet the shared uplink in front of them all fills anyway. That is a carpet bombing attack, and reproducing it is one of the evasive cases a thorough DDoS test has to cover. Also called a spread-spectrum or spray attack, it is built to defeat defenses that watch one victim at a time.

Carpet bombing: spread thin per host, saturating in aggregate Botnet spray attack Target /24 prefix, hit host by host 203.0.113.17under trigger 203.0.113.62under trigger 203.0.113.128under trigger 203.0.113.201under trigger 203.0.113.244under trigger no single host crosses its per-IP limit but every packet shares one path aggregate each IP too low Shared uplink saturated Per-IP mitigation never triggers A test characterizes whether detection aggregates across the whole prefix and can mitigate at CIDR granularity. BlackNeuron
A carpet bombing attack spreads the flood across many hosts in a prefix so no single IP crosses its per-IP threshold, yet the aggregate saturates the shared uplink.

How carpet bombing spreads the load

At heart this is a volumetric attack: the goal is still to deliver more traffic than a circuit can carry until clean packets are dropped at the hop that fills first. What is specific to carpet bombing is the geometry. Instead of aiming the whole flood at one destination, the attacker divides it across every address in a target's prefix, a full /24, a /22, or something larger.

Each individual host receives only a small share, comfortably below the rate any per-destination counter would flag. The prefix as a whole, and the router or transit circuit that serves it, absorbs the entire aggregate. The victim is the network segment, not any one machine on it.

That geometry is chosen for exactly one reason: most detection samples per address. NetFlow and sFlow thresholds, per-IP rate limits, and the triggers that fire on-demand mitigation all watch individual destinations. Carpet bombing is engineered so no destination stands out, so the signal those systems look for never appears even while the pipe is saturated.

Security vendors began cataloguing the pattern as a distinct technique around 2018, when campaigns against hosting providers and ISPs sprayed floods across whole customer prefixes rather than a single tenant. Because the traffic is diffuse, the carrying network often registers congestion before it can point at a victim at all.

Why it matters under attack

The trouble is one of scope. A defense pointed at a single victim IP has nothing to catch, because no victim IP is above its line. The attack only exists as a signal when you sum traffic across the whole prefix, so detection has to aggregate at CIDR granularity or it is blind to the thing happening in front of it.

The blunt fallback then backfires. Reach for RTBH to null-route the target and you discover there are hundreds of targets: black-holing the whole /24 drops every legitimate host in it at once, so the mitigation becomes the outage across the entire segment. Finer, flow-aware tools like BGP Flowspec exist precisely because a per-address response cannot answer a per-prefix attack. The aggregate itself is still counted in bits per second; what changed is where you have to measure it.

Carpet bombing: one flood spread across a whole prefix distributed sources target /24 no host stands out each address gets a trickle; the prefix and its uplink absorb the sum BlackNeuron
Animated carpet bombing: a distributed flood is split across every address in a target prefix, each host taking only a trickle that stays under its own limit while the shared uplink saturates from the sum

What a DDoS test measures

A carpet bombing test characterizes whether detection aggregates across a prefix rather than per host, and how fast subnet-level or flow-based mitigation engages once the diffuse pattern starts. The honest result is the aggregate rate at which the prefix-level trigger fires, not a per-IP number, because a per-IP number never moves.

It also checks the cost of the only response many networks have. If the sole available control is a CIDR blackhole, the test records the collateral: how many legitimate addresses go dark to stop the flood. Where carpet bombing sits among the flooding vectors it is routinely mistaken for is laid out in Understanding DDoS Attack Vectors.