Firewall DDoS Filter Simulator

A distributed denial-of-service attack tries to exhaust a server by burying its real traffic in a flood of spoofed requests. This simulator models the defence at the firewall gate: one legitimate client lane and five botnet lanes feed packets toward a server, and every packet is checked against a rate-limiting rule before it is allowed through. With stateful inspection off, the firewall only sees source IPs — and since a spoofed IP always looks brand new, the flood walks straight past a simple ACL and the server saturates. Switch stateful inspection (SYN cookies) on and the firewall instead checks whether each connection's handshake actually completes, dropping a share of the flood set by the strictness slider regardless of how many IPs it spoofs. Tune legitimate traffic, attack intensity and strictness to see how allowed rate, blocked rate and server load respond.