All DDoS Definitions
DDoS Testing Definition

Requests Per Second (RPS)

Requests per second (RPS) is a metric, one of the core rate units a thorough DDoS test is built to measure. It counts how many HTTP or HTTPS requests an application receives each second, often expressed at DDoS scale as kilo-requests per second (KRPS). RPS is the dimension that defines application-layer (L7) floods: each request is small on the wire but expensive at the origin, where it costs CPU, a worker thread, a TLS handshake, and often a database query, so a modest bandwidth figure can still exhaust the backend.

Requests per second: cheap on the wire, costly at the origin Clients / bots many HTTP requests small on the wire small requests Origin (app tier) each request is expensive: TLS handshake worker thread CPU cycles DB query bandwidth on the wire modest Gbps request rate (RPS) worker pool and database exhausted at a few KRPS A test drives RPS at the expensive endpoints, where small requests still exhaust CPU, worker threads, and the database. BlackNeuron™
Diagram of requests per second: small HTTP requests that are cheap on the wire but expensive at the origin, where RPS exhausts worker threads, CPU, and the database at a few KRPS

Why it matters in DDoS testing

L7 attacks are measured in request rate, not bandwidth, because the cost lives in the application, not the link. A server that streams video happily at 10 Gbps may fall over at a few thousand RPS of uncached dynamic requests. A test drives RPS against the expensive endpoints to find where worker pools, connection limits, and the database tier give out.

The application-layer attack classes behind this metric are covered in understanding DDoS attack vectors.