All DDoS Definitions
DDoS Testing Definition

SSL Flood (TLS Handshake Flood)

An SSL flood, also called a TLS handshake flood, is a Layer 7 attack vector, one of the classes a thorough DDoS test is built to exercise. The attacker opens many TLS connections and forces the server through the full handshake, where the asymmetric key operation is far costlier for the server than for the client. By abandoning each session after the handshake and opening another, the attacker exhausts CPU on cryptographic work at very low bandwidth, so the link looks idle while the server stalls.

SSL flood: many handshakes, each abandoned, CPU drained Many short TLS connections conn 1: handshake then drop conn 2: handshake then drop conn 3: handshake then drop conn 4: handshake then drop reopen and repeat thousands, low bandwidth full handshake each TLS terminator asymmetric key op server pays the cost crypto work per handshake Server CPU saturated link near idle Below the bits-per-second alarms, this surfaces as rising handshake latency and CPU load A test characterizes the handshake rate at which the terminator degrades and whether resumption and offload hold. BlackNeuron™
An SSL flood opens many TLS connections and forces each through the full handshake, then abandons it, draining server CPU on asymmetric crypto while bandwidth stays low.

Why it matters in DDoS testing

SSL floods sit below the bandwidth thresholds most volumetric defenses watch, so they slip past bits-per-second alarms and surface as rising handshake latency and CPU saturation. Testing measures the handshake rate at which the TLS terminator (origin, load balancer, or CDN edge) degrades, and whether session resumption and offload hold. Characterizing that knee point is the work of DDoS resilience testing.