Command-and-control (C2) works by having thousands of compromised machines wait for a few bytes of instruction, rather than by having an operator drive each one by hand. It is the channel that turns a botnet into one coordinated source, and the timing it imposes on an attack is what a DDoS test has to reproduce. Through it the operator pushes the target, the vector, the duration and the options; the bots poll or listen, and act on the order together.
What an order contains
How C2 channels are built, from central IRC and HTTP servers to peer-to-peer gossip and generated domains, is covered on the botnet page. For a defender, what the order says matters more than how it travels.
Mirai's attack command is a useful worked example, because its source code leaked in 2016. One order carries a duration in seconds, an attack type chosen from the built-in modules, a list of targets each with its own netmask, and options such as payload size, destination port or a domain name.
The netmask is the detail people miss. A single order can name a whole /24, so the fleet spreads across every address in the prefix instead of one. That is carpet bombing issued as one command.
The duration field is just as telling. Booter plans are sold by maximum attack length, and most rented attacks run for a fixed time set when the order is sent, then stop without warning. An attack that ends on its own was not mitigated. It expired.
How the channel shapes the attack
The control channel sets the attack's edges. A fleet holding a persistent connection to its controller starts within a second or two of the order, so the flood arrives as a step. A fleet that polls every few minutes ramps up across the polling interval as each bot checks in. Detection tuned on gradual ramps can lag against a step, and a threshold that only fires on a sudden jump can sleep through a slow climb.
Pivots follow the same timing. When the operator swaps a UDP flood for an HTTP flood, the whole fleet changes vector in the time one order takes to propagate, far faster than a person can write and push a new rule. Rules built for the first vector stay in place afterwards, matching nothing, and sometimes catching real users.
The channel is also where attacks are ended for good, though not by the victim. Seizing a C2 domain or sinkholing it cuts off every bot that resolves it. Law enforcement goes after the rental layer as well: the Europol-coordinated Operation Power Off began in April 2018 with the takedown of webstresser.org and has seized booter domains in repeated rounds since. None of that is a lever the target holds during an attack.
What a DDoS test measures
A test never builds or uses a real C2 over machines it does not own. What it borrows is the shape C2 gives an attack: a step start, a pivot to a second vector partway through, a pause and a resumption, a stop with no ramp-down.
Each edge is its own measurement. How long until mitigation engages after the step, how long until it re-engages after the pivot, whether rules written for the first vector linger, and whether anything in the response treats the pause as the end of the incident.
A test has a control plane of its own, the orchestration that tells its generators to start and stop. The stop is the half that matters. The time from "halt" to traffic actually ceasing at the target is a safety number, and it should be measured before the first real run rather than discovered during one. What that means for deciding how hard a test may push live systems is worked through in Running a DDoS Test Without Disrupting Production.