3D Network Topology Defense Simulator

Network Topology

Legitimate traffic 6 pkt/s

Attack intensity per bot 8 pkt/s

Botnet size 6 nodes

Inspection strictness 0.70

Allowed / s

–

Blocked / s

–

Server load

–

Botnet edges

–

How it works

This is the same firewall vs. DDoS contest as the 2D lane version, but simulated on an explicit graph instead of a flow field: a client node and a ring of botnet nodes each hold their own edge into the firewall node, and every request travels that edge as a discrete packet before the firewall makes a per-packet keep/drop decision at the node itself. Passed packets then travel a second edge on to the server node. Because each botnet node is its own graph vertex, growing the botnet size literally adds more converging edges rather than raising a single aggregate rate — the topology itself gets denser, which the flat 2D version cannot show.

per packet at firewall node:
  if type == attack:
    dropped = statefulOn ? (rand() < strictness) : false   // spoofed edge ⇒ ACL blind
  if !dropped: spawn new packet on edge(firewall → server)
serverLoad = allowedPackets(last 1s) / serverCapacity

Legitimate traffic — packet rate the honest client sends down its single edge to the firewall.
Attack intensity per bot — packet rate each individual botnet node sends down its own edge.
Botnet size — number of distinct attacker nodes/edges converging on the firewall; a topology parameter with no equivalent in a single aggregate flow.
Inspection strictness — per-packet probability the stateful check correctly flags a spoofed handshake, once inspection is on.

Real-world relevance: real DDoS mitigation sits exactly at this node — a scrubbing appliance or firewall on the path between many spoofed peers and one server, deciding per-packet whether a connection's state (not its claimed source) earns it a path onward.

Legitimate packet Attack packet (pre-firewall) Passed firewall Blocked flash

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.