Unlike a sustained flood, which a scrubbing system can lock onto and filter for as long as it lasts, a pulse wave attack never stays in one place long enough to be caught. It delivers short, sharp bursts of full-force traffic on a repeating cadence, often one every few minutes, and it is one of the timing-based classes a thorough DDoS test is built to exercise. Each pulse ramps to peak almost instantly, then stops before mitigation stabilizes, and the next pulse arrives before defenses have stood down.
Why the cadence is the weapon
A pulse wave is volumetric in payload: it saturates links and state the same way a volumetric attack does. What sets it apart is timing, not peak size.
The design assumes a specific defensive property. Most scrubbing and detection systems expect a gradual ramp, so they engage on a delay, take a cold-start time to mitigate measured in tens of seconds, and stand down once traffic looks clean again. A pulse wave is built to live entirely inside that reaction window. The burst is over before a scrubbing center fully diverts, and by the time the system decides the threat has passed and releases, the next pulse is already inbound.
The pattern was first characterized in 2017, when repeated, precisely timed bursts were seen pinning appliance-based defenses that handled the same volume without trouble when it arrived as one continuous flood. Sophisticated campaigns rotate vectors between bursts, one pulse a UDP flood, the next an HTTP flood, so a filter tuned to the last burst is wrong for the next. The cadence itself is a knob the attacker controls: shorten the period to keep mitigation from ever settling, lengthen it to stay under the averaging window of a rate alarm.
Why it matters under attack
The failure a pulse wave produces is intermittent, which makes it hard to diagnose and easy to under-count. The site is not down; it browns out for tens of seconds every few minutes, and each brownout lines up with a scrubbing cutover rather than the raw traffic peak.
Two properties make it dangerous in production. Repeated cutover is not free: every time mitigation engages and releases, legitimate connections can be reset, caches re-warm, and TLS sessions renegotiate, so the act of defending becomes part of the damage. And an always-on posture that a slow ramp would justify is exactly what a pulse wave is designed to avoid triggering, so a team relying on reactive, on-demand scrubbing is the intended victim.
What a DDoS test measures
A test for this vector is a timing measurement, not a volume one. It drives pulses at a controlled cadence and characterizes three numbers: how long mitigation takes to engage from a cold start, whether it stays engaged between bursts or fully deactivates and pays the cold start again on every pulse, and what the repeated cutover costs legitimate traffic.
The useful deliverable is the shortest pulse period the defense survives without degrading, because that is the knob the attacker actually turns. A stack that scrubs a continuous flood cleanly can still fail a pulse wave at the same peak rate purely on reaction latency, and the only way to know is to run the cadence rather than the sustained case. What that reaction window means for the rest of the mitigation pipeline is worked through in DDoS resilience testing.