All DDoS Definitions
DDoS Testing Definition

ICMP Flood (Ping Flood)

An ICMP flood, often called a ping flood, is a Layer 3 (network) attack vector, one of the volumetric classes a thorough DDoS test is built to exercise. The attacker sends a high rate of ICMP echo-request packets (or other ICMP types) to the target, forcing it to process each one and, for echo requests, generate an echo-reply. At scale this consumes both inbound link capacity and CPU on the responding host, and spoofed source addresses make per-source blocking ineffective.

ICMP Flood: raw echo-request volume saturating the link Spoofed sources bot bot bot per-source blocking fails high rate of echo requests Target must reply to each echo request inbound pipe + CPU carry the load Saturation link + softirq budget fill up before the app No reflection, no reflector: pure volume the flood hits the target directly A test finds the rate at which the link or the kernel softirq budget saturates, and whether edge rate-limiting engages cleanly. BlackNeuron™
Diagram of an ICMP flood: many spoofed sources send a high rate of echo-request packets straight at the target, saturating the inbound link and the kernel CPU budget before any application control sees it.

Why it matters in DDoS testing

ICMP floods are simple but still expose real gaps: many environments leave ICMP unrated at the edge, so a flood saturates the pipe before any application control sees it. Testing measures the rate at which the link or the kernel softirq budget saturates, and confirms that edge rate-limiting or ICMP filtering engages cleanly. Validating that under controlled load is the point of DDoS resilience testing.