All DDoS Definitions
DDoS Definition

Christmas Tree Attack

A Christmas tree attack is a Layer 4 (transport) attack vector, one of the attack classes a thorough DDoS test is built to exercise. It floods a target with TCP packets that have an unusual set of header flags turned on at once, classically FIN, PSH, and URG (sometimes every flag), so the header lights up like a string of Christmas lights. A packet carrying contradictory flags falls outside the normal handshake, so many operating-system stacks and inline devices take a slower code path to parse it and decide what to do, spending several times the CPU of an ordinary packet. Sent at high rates, that per-packet cost is the attack: the target and its stateful firewalls exhaust processing capacity on malformed packets. The same crafted packets are also used to fingerprint an operating system by how its TCP stack responds to flag combinations the RFCs never fully specify.

Christmas tree attack: every flag lit at once Normal packet (one flag) URG ACK PSH RST SYN Christmas tree packet (flags lit up) URG ACK PSH RST FIN contradictory flags, no valid handshake state TCP stack / firewall fast path: cheap to process slow path: parse odd flags, decide what to do CPU exhausted several times the cost of a normal packet, sent at high rates Test measures how many malformed-flag packets per second the stack absorbs before latency climbs, and whether the edge drops odd flag combinations statelessly. BlackNeuron
Christmas tree attack: a TCP packet with FIN, PSH, and URG flags all set forces the stack down a slow parsing path that costs several times the CPU of a normal single-flag packet

Why it matters in DDoS testing

A Christmas tree attack targets the per-packet processing cost of the TCP stack rather than link bandwidth, so a defense sized only for volume can miss it. A DDoS test measures how many malformed-flag packets per second the stack and inline devices absorb before latency climbs or legitimate connections fail, and whether stateless filtering drops contradictory flag combinations at the edge. For where this sits among the network-layer classes, see Understanding DDoS Attack Vectors.