A LAND attack is a Layer 4 (transport) attack vector, one of the classic classes a thorough DDoS test is built to exercise. The attacker crafts a TCP SYN packet whose source IP and port are set equal to the destination IP and port, so the target appears to be opening a connection to itself. A vulnerable stack replies to its own SYN-ACK in a loop, consuming CPU and potentially hanging. Modern kernels drop such packets, but the vector persists as a test for spoofing filters and malformed-packet handling.
Why it matters in DDoS testing
LAND is largely historical against patched systems, yet it still probes a real control: whether the edge drops obviously spoofed and self-addressed packets before they reach the host. Testing confirms that ingress filtering and anti-spoofing rules catch malformed source addresses rather than passing them inward. The role of spoofing across attack classes is detailed in Understanding DDoS Attack Vectors.