A volumetric attack works by filling the network link itself, not by exhausting connection state or abusing application logic. Saturating a pipe until legitimate packets are discarded is the bluntest failure a DDoS test has to reproduce, and the one counted in raw bits per second. The premise is arithmetic: deliver more traffic than the transit, peering, or origin circuit can carry, and the surplus is dropped at whichever hop fills first, real users and attack packets alike.
How a volumetric attack works
The target is the link, not the host behind it. A server can sit idle, its CPU cool and its connection tables nearly empty, and still be unreachable because the circuit in front of it is full. Congestion does all the work, so the attacker never has to complete a handshake or send a request the application would even parse.
Traffic at that scale comes from one of two engines, often both at once. The first is distribution: a botnet of thousands of hosts each emits a stream of packets, and the sum arrives as a wall. The second is amplification, where a small spoofed query to an open reflector returns a response many times its size, so a modest uplink can throw hundreds of gigabits at a victim with no large botnet behind it.
What ties the class together is the unit. Volume is measured in bits per second, the number that has to exceed link capacity for the attack to bite. That is a different axis from a protocol attack, counted in packets per second against a finite state table, and from an application-layer attack, counted in requests per second against CPU and the database. A stack can hold generous headroom on one axis and almost none on another, which is why the three classes are exercised separately rather than as one number.
Why it matters under attack
No single origin link can absorb a modern volumetric flood. Hundreds of gigabits, and at the top end terabits, exceed what any one datacenter circuit is provisioned to carry, so the defense cannot live at the origin at all. It has to be upstream, in scrubbing capacity and in anycast that scatters the load across many edge sites before it converges anywhere near the target.
The failure is collateral by nature. Because the attack fills a shared pipe, it degrades everything behind that pipe and not just the named target: neighboring services, other tenants, the circuit's other customers. The headline record-breaking numbers you read about are almost always volumetric, because bits per second is the one dimension that photographs well, but the same shared-link mechanism is what makes a mid-sized flood take down more than it aimed at.
Volume is also shaped to slip past the defense rather than merely maximized. Carpet-bombing spreads the same aggregate flood thinly across an entire address range, so no single destination crosses a per-IP alarm even though the upstream link is saturated. Pulse-wave delivery sends short, repeated bursts timed to the reaction speed of on-demand mitigation, keeping the scrubbing tier forever a step behind. Both are volumetric in resource and unit; what changes is the distribution in space and time, which is why a test has to probe how the mitigation reacts to shape, not just to peak.
What a DDoS test measures
A volumetric test finds the absorption ceiling: the point where added attack volume starts costing legitimate throughput. It clocks the latency scrubbing adds to the clean-traffic path, how fast mitigation engages once the flood begins, and whether anycast is genuinely dispersing the load or quietly funneling it to one site that then tips over on its own.
It also has to confirm the edge is actually in front of the traffic. An origin whose real address is reachable directly can be flooded around the scrubbing tier entirely, so a volumetric test doubles as a check that there is no path to the origin that skips the absorbing layer. Where volumetric floods sit among the other attack classes is laid out in Understanding DDoS Attack Vectors.