Unlike a reflection flood, a UDP flood does not borrow a stranger's bandwidth to hit you; the attacker points datagrams straight at the target from the hosts they already control. That directness is what a DDoS test has to reproduce for this vector: not a clever trick, but the raw rate at which packets arrive and the point where the link or the kernel gives out. It is a volumetric attack, so it shares the family goal of filling the pipe until clean traffic is dropped, but it is the un-amplified base case. One datagram sent is one datagram delivered, an amplification factor of one, which is the whole distance between this and UDP reflection.
How a UDP flood works
UDP is connectionless. There is no handshake and no state to set up, so an attacker can spray datagrams as fast as the uplink allows and forge the source address on every one for free. That alone separates it from a SYN flood or an HTTP flood, which need either completed handshakes or a botnet of real hosts. A UDP flood needs neither, which is why it is the default weapon of the cheapest booter services.
The datagrams land in one of two ways, and the two shapes fail differently. Against a closed port, the host receives the packet, walks its socket table for a listener, finds none, and generates an ICMP destination-unreachable message (type 3, code 3) in reply. That lookup-and-reply cycle costs CPU on every single packet. When the source is spoofed, the ICMP reply is aimed at the forged address instead of the attacker, so an uninvolved third party collects the backscatter. Against a fixed open port, a real UDP service such as DNS, a VoIP endpoint, or a game server, there is no ICMP reply at all. Instead the service itself has to receive and parse every datagram, which is usually the more expensive of the two.
Because a bare UDP datagram can be tiny, a UDP flood is counted in packets per second as much as bits per second. A flood of 64-byte packets can be trivial on a bandwidth graph and still bury a CPU, because the cost of classifying a packet is paid whether the packet is large or small.
Why it matters under attack
The reply cost has a specific defensive knob most teams never check. Linux rate-limits the ICMP error messages a host will emit, through net.ipv4.icmp_ratelimit and the icmp_ratemask that selects which types are throttled, and destination-unreachable is masked by default. A correctly tuned kernel throttles its own backscatter rather than melting a core generating replies, so confirming that limit is engaged is part of surviving the closed-port case.
The vector is a stresser staple precisely because it needs no infrastructure. The leaked Mirai source shipped two versions of it: a generic UDP flood and a stripped-down "UDP plain" flood tuned to push the highest packet rate the bots could manage with the least per-packet work. When Mirai and its variants took down large targets in 2016, plain UDP was one of the attack modules its command channel could fire on demand, alongside the SYN and ACK floods.
What a DDoS test measures
A UDP flood test characterizes two ceilings at once: the bits per second the link absorbs, and separately the packets per second the NIC and kernel can classify before the interface queue overflows. The packets-per-second ceiling is the one teams miss, because a flood of small datagrams can pin a CPU core's softirq handling long before the bandwidth graph looks alarming. The honest result is a packet rate and the name of the queue or core that saturated first, not a headline in gigabits.
It then checks that stateless filtering actually holds under that load. Dropping UDP to closed ports at the edge, rate-limiting per source, and confirming the kernel's own ICMP-reply throttle is on are all things that look correct in a config file and still fold when the packets arrive fast enough. And because a real service on an open port cannot be filtered by "drop UDP to closed ports," the test has to push the service itself and find where its parser or worker pool gives out. What that leaves a defender to decide, mainly how much upstream scrubbing capacity to size against a flood no origin link can hold alone, is worked through in DDoS resilience testing.