A Christmas tree attack is a Layer 4 (transport) attack vector, one of the attack classes a thorough DDoS test is built to exercise. It floods a target with TCP packets that have an unusual set of header flags turned on at once, classically FIN, PSH, and URG (sometimes every flag), so the header lights up like a string of Christmas lights. A packet carrying contradictory flags falls outside the normal handshake, so many operating-system stacks and inline devices take a slower code path to parse it and decide what to do, spending several times the CPU of an ordinary packet. Sent at high rates, that per-packet cost is the attack: the target and its stateful firewalls exhaust processing capacity on malformed packets. The same crafted packets are also used to fingerprint an operating system by how its TCP stack responds to flag combinations the RFCs never fully specify.
Why it matters in DDoS testing
A Christmas tree attack targets the per-packet processing cost of the TCP stack rather than link bandwidth, so a defense sized only for volume can miss it. A DDoS test measures how many malformed-flag packets per second the stack and inline devices absorb before latency climbs or legitimate connections fail, and whether stateless filtering drops contradictory flag combinations at the edge. For where this sits among the network-layer classes, see Understanding DDoS Attack Vectors.