A load balancer is a traffic-distribution control, and in DDoS terms a defensive layer whose behavior under flood a thorough DDoS test is built to validate. It sits in front of a backend pool (at Layer 4 as a network load balancer, or at Layer 7 as an application load balancer or reverse proxy) and spreads incoming connections across healthy nodes, removing failed ones from rotation through health checks. Against volumetric or connection-exhaustion attacks it can absorb load by fanning traffic across capacity, but it is also a chokepoint in its own right: its connection state table, TLS-termination CPU, and health-check logic can each become the layer of first failure before any backend node is touched.
Why it matters in DDoS testing
A load balancer is often assumed to be pure spare capacity, but under a connection flood its state table (or the accept queue behind it) saturates while backends sit idle, and cascading health-check failures can pull healthy nodes out of rotation exactly when the pool is needed most. A DDoS test measures where that ceiling actually sits: connection setup rate, concurrent-connection limits, TLS handshake throughput, and whether health checks flap under partial load. Establishing those limits safely, without taking production down in the process, is the core constraint explored in DDoS Resilience Testing.