All DDoS Definitions
DDoS Testing Definition

LOIC (Low Orbit Ion Cannon)

LOIC (Low Orbit Ion Cannon) works by having each participant flood a target from their own computer and their own address, rather than by commanding a fleet of hijacked machines. That makes it the commodity end of DDoS tooling, the kind a DDoS test safely and lawfully reproduces in a controlled, authorized form. It is an open-source stress-testing application that floods a target with TCP, UDP, or HTTP requests from the machine it runs on.

Originally a load-testing utility, it became notorious as the tool behind several volunteer "hacktivist" campaigns, where many operators pointed their copies at one target at the same time. A successor, HOIC (High Orbit Ion Cannon), focuses on HTTP floods with request randomization.

LOIC: many volunteers, one target, no anonymity No botnet. No skill barrier. No source anonymity: each operator's real IP is exposed. Volunteer PC 1 runs LOIC · real src IP Volunteer PC 2 runs LOIC · real src IP Volunteer PC 3 runs LOIC · real src IP Volunteer PC 4 runs LOIC · real src IP Volunteer PC 5 runs LOIC · real src IP One target many independent copies firing at the same time Absorbed at the edge basic rate limiting + IP reputation soak it The danger is coordinated volume, not sophistication: one tool, no skill barrier, and no source anonymity. A test confirms commodity tools like this are soaked up long before advanced vectors are needed. BlackNeuron™
LOIC as many volunteers each firing their own copy at one target with no source anonymity, a commodity flood absorbed by basic rate limiting and IP reputation

How LOIC is used

The interface is a single window: type a URL or an IP address, pick TCP, UDP or HTTP, set a thread count, press the button. The TCP and UDP modes send a repeated message at the target's port as fast as the machine allows. The HTTP mode sends a stream of requests for one URL, which makes it an HTTP flood of the plainest kind.

What turned a load tester into a campaign tool was the "Hive Mind" mode. Instead of choosing a target locally, a copy connects to an IRC channel and fires wherever the channel's operator points it. Thousands of volunteers can hand control of their machines to one person. That is a botnet in structure, with one difference that decides everything else: every member joined on purpose, and every member is sending from their own address.

Browser versions followed, running the same HTTP flood from a web page, so taking part needed no download at all.

The campaigns, and why the participants got caught

LOIC was the visible tool in the Anonymous campaigns against the Church of Scientology in 2008 and, more widely, in Operation Payback in December 2010, when volunteers targeted the websites of payment companies that had stopped processing donations to WikiLeaks. Some of those sites were knocked offline for hours.

LOIC does nothing to hide where its traffic comes from. Each packet carries the participant's real source address, and the target's logs record it. Police in the United States, the United Kingdom and the Netherlands made arrests in the months after Operation Payback, and in the US case a group of defendants were charged over the attacks on PayPal. The tool's lack of anonymity is the best-documented fact about it.

LOIC: every volunteer copy is one loud, unhidden address incoming requests per-source limit keyed on the real source IP origin real users served customer requests at a normal rate a volunteer copy, flooding from a home IP BlackNeuron™
Animation of LOIC traffic: real customer requests pass a per-source limit while each volunteer's copy, a loud stream from one unhidden home address, is cut at the edge

What a DDoS test measures about it

LOIC-class traffic marks the bottom of the realistic range: no botnet, no spoofing, no skill barrier. Its danger comes from coordinated volume rather than sophistication, so a defense that fails here has a configuration problem, not a capacity one.

The traffic has properties a test can lean on. Each source is loud, because one person's copy sends far more than any real user. The requests are repetitive, often the same URL or the same payload again and again. And the addresses are real and stable for the length of the attack. A test confirms that:

  • Per-source rate limiting engages at a threshold below a single copy's output and above a busy legitimate client's.
  • Repeated identical requests are absorbed by the cache or filtered on their sameness before they reach the origin.
  • Somebody notices. A commodity flood that the edge absorbs silently is fine; one that is absorbed but never alerted on leaves the next, larger attempt unwatched.

What that means for a defender whose attack dates are set by the news cycle is worked through in DDoS testing for the public sector.