The GRE flood entered most defenders' vocabulary in 2016, when the Mirai botnet used it in the record-setting attacks on Krebs on Security and OVH. It endures because the protocol it abuses, GRE, sits outside the rate controls most edges apply to TCP and UDP, so it remains one of the volumetric classes a thorough DDoS test is built to exercise.
How a GRE flood works
GRE, Generic Routing Encapsulation, is IP protocol 47. It is not TCP or UDP and it has no port numbers; it is a tunnelling protocol that wraps one packet inside another so traffic can cross a network as if through a private pipe. Legitimately it carries PPTP VPNs, mobile backhaul, and SD-WAN overlays.
A GRE flood sends high rates of GRE-encapsulated packets at the target. Like any volumetric attack the crude effect is link saturation, but GRE adds a second cost: every packet has to be decapsulated, and that work lands on the CPU of the router or firewall doing it. The attack therefore bites on two resources at once, the wire and the processor unwrapping frames on it.
Two forms show up in the wild. A GRE IP flood carries encapsulated IP packets; a GRE Ethernet flood carries whole Ethernet frames, which are larger and heavier to process. Mirai shipped both as distinct modules, ATK_VEC_GREIP and ATK_VEC_GREETH, in the source code released after the 2016 attacks. Because GRE is connectionless and stateless, the source addresses can be spoofed as freely as in any IP-spoofing vector, so the flood needs no completed handshake behind it.
Why it matters under attack
The reason GRE is dangerous is neglect, not cleverness. Firewalls and routers are tuned to police the protocols operators think about, TCP and UDP, and protocol 47 often slips through with no rate limit and no ACL to catch it. A device that would shrug off an equivalent UDP flood can fall over decapsulating GRE, because the decapsulation path, not the bandwidth, becomes the layer of first failure.
Mirai made this concrete. The botnet, built from hundreds of thousands of compromised IoT devices, drove GRE floods measured in hundreds of gigabits, and the released source turned the technique into a template that copycats have used ever since. The lesson was not that GRE is exotic but that a protocol nobody was watching is exactly the one worth flooding.
Because the attack is spoofable and connectionless, source reputation buys little. The arriving packets are well-formed GRE from thousands of forged addresses, so the defence is upstream absorption and dropping unexpected protocol 47 at the edge, not identifying a sender.
What a DDoS test measures
The exercise breaks into three parts. First, whether unexpected GRE is dropped or rate-limited at the perimeter before it reaches anything that has to unwrap it. Second, whether the decapsulation path becomes the bottleneck ahead of raw bandwidth, since a device can have link headroom to spare and still exhaust the CPU unwrapping frames. Third, how recovery behaves once the flood lifts, because a router pinned on decapsulation does not always come back cleanly.
That combination, a resource that gives way before the pipe does and a recovery curve worth measuring, is why GRE belongs in the sustained-load portion of a test. The volumetric family it sits in, and how a stack holds up and recovers under that load, is the subject of DDoS Resilience Testing.