A denial-of-service (DoS) attack is an availability attack, the failure class every DDoS test is designed to provoke and measure. It aims to make a service unreachable to legitimate users by exhausting a finite resource: bandwidth, CPU, memory, connection state, or an application worker pool. A classic DoS originates from a single source, so filtering one address usually stops it. A distributed denial-of-service (DDoS) spreads the same load across thousands of hosts, which is why source-based blocking alone fails and mitigation has to key on behavior, protocol conformance, and rate rather than origin.
Why it matters in DDoS testing
DoS is the outcome; the vector is how you reach it. A test does not just confirm that a flood causes an outage, it identifies which resource fails first and at what load, so the fix targets the real bottleneck rather than the symptom. That layer-of-first-failure question is the core of DDoS resilience testing: whether the accept queue, the WAF, the origin CPU, or an upstream link gives way, and whether mitigation engages before users notice the degradation.