All DDoS Definitions
DDoS Testing Definition

HTTP/2 Rapid Reset

HTTP/2 Rapid Reset is a Layer 7 (application) attack vector, one of the classes a thorough DDoS test is built to exercise. Tracked as CVE-2023-44487, it abuses HTTP/2 stream multiplexing: the attacker opens a request stream and immediately cancels it with a RST_STREAM frame, then repeats at high speed over a single connection. The server does the work of setting up and tearing down each stream while the client pays almost nothing, so a small number of connections generates enormous request churn that drives record-setting request-per-second floods.

HTTP/2 Rapid Reset: open a stream, cancel it, repeat Attacker one HTTP/2 connection near-zero cost 1. HEADERS: open a stream 2. RST_STREAM: cancel instantly repeat thousands / sec Server sets up + tears down every stream cancel frees the slot, but the work already ran request churn RPS flood record request rates, tiny bandwidth Canceled streams do not count against the max-concurrent-streams limit, so the churn never throttles A test drives request-and-cancel churn to confirm stream and reset-rate limits hold, not just that the CVE patch is applied. BlackNeuron™
Diagram of HTTP/2 Rapid Reset: over one connection the attacker opens a stream with HEADERS and cancels it with RST_STREAM thousands of times per second, while canceled streams never count against the server's concurrency limit.

Why it matters in DDoS testing

Rapid Reset showed that a protocol feature, not a volumetric pipe, can be the attack surface, and that patched servers still need tuned stream and reset limits. Because the vector targets the application tier, exercising it safely against real services without causing an outage is the discipline covered in running a DDoS test without disrupting production.