Unlike a black hole, a sinkhole does not discard the traffic it attracts; it accepts it, at a destination built to receive it, so the traffic can be counted and studied while the real target stays out of reach. It is a network-layer defensive control, and whether the diversion is fast enough, large enough and selective enough is something a DDoS test can measure. Where RTBH and a local null route send packets to the floor, a sinkhole sends them to a collector that logs sources, ports and payloads.
Three things called a sinkhole
The word covers three related techniques, and it helps to know which one a plan means.
A routing sinkhole announces the attacked address, or a more specific prefix, toward a dedicated router or server inside the network. Traffic for that address follows the announcement there instead of to the origin. The sinkhole has to have the capacity to take the whole flood, which is the main practical difference from a discard route: a null route costs nothing, and a sinkhole costs a circuit and a box big enough to drink from it.
A darknet, or network telescope, advertises address space that has no hosts in it. Nothing legitimate should arrive there, so whatever does is scanning, misconfiguration or backscatter. In 2001 researchers at UCSD used a telescope covering a /8 to estimate worldwide DoS activity from the replies that victims of spoofed floods sent to the random forged addresses, and telescopes still run on the same principle.
A DNS sinkhole answers queries for known malicious domains with an address the defender controls. It is how botnet command channels are cut: the Conficker working group sinkholed that worm's rendezvous domains in 2009, and registering the WannaCry kill-switch domain in May 2017 halted that worm's spread. It matters to DDoS because a sinkholed command-and-control domain is a botnet that can no longer be told what to attack.
What it gives a defender that a discard does not
A black hole tells you that something was large enough to need dropping. A sinkhole tells you what it was: which source ports, which packet sizes, how many distinct sources, whether the flood is reflected or direct. That record is what turns a guess into a precise filter rule.
It also has a limit worth stating plainly. Source addresses captured in a sinkhole are only trustworthy for traffic that completed a handshake. For a spoofed flood they identify nobody, and a block list built from them hits innocent networks.
The sinkhole must also stay silent. A collector that answers SYNs or sends ICMP errors turns diverted attack traffic into a second flood leaving your own network.
What a DDoS test measures
A test times the diversion, from the announcement to the moment attack traffic stops arriving at the origin and starts arriving at the collector, and confirms the route propagated to every edge the flood can enter by.
It checks capacity. The collector and its link have to hold the test volume without dropping, or the record has holes exactly where the attack was largest.
And it checks selectivity. If the sinkhole route covers a wider prefix than the target, legitimate traffic to neighbouring addresses lands in the collector too, which is an outage with good logging.
Sinkholing is one of several places where a mitigation has to be judged on what it costs as well as what it stops, and DDoS resilience testing sets out the rest.