A PSH-ACK flood is a Layer 4 (transport) attack vector, one of the attack classes a thorough DDoS test is built to exercise. It floods the target with TCP packets that have both the PSH (push) and ACK flags set. In a normal session the PSH flag tells the receiver to hand buffered data straight to the application rather than holding it in the kernel buffer, so every packet demands immediate processing. Because these packets belong to no session the target ever established, a stateful firewall, load balancer, or server checks each one against its connection table, finds no match, and drops it, all while the PSH flag pushes the stack to act at once. The cost is CPU, not bandwidth: at millions of packets per second the device spends its cycles inspecting and discarding traffic instead of serving real users.
Why it matters in DDoS testing
A PSH-ACK flood is a connection-table and CPU attack, not a bandwidth attack, so a stack provisioned only for volumetric floods can still fall over at modest traffic rates. A DDoS test measures how many spurious PSH-ACK packets per second the firewall and its conntrack table absorb before legitimate sessions start failing, and whether stateless filtering or a flag-based rate control holds under load. For where this sits among the network-layer classes, see Understanding DDoS Attack Vectors.