Firewall DDoS Filter Simulator

Firewall / DDoS

Legitimate traffic 15 req/s

Attack intensity (botnet) 120 req/s

Inspection strictness 0.70

Allowed / s

–

Blocked / s

–

Server load

–

Spoofed sources

–

How it works

Every source — one legitimate client, five botnet lanes — feeds packets into a firewall gate. Each source normally gets its own token bucket: a request passes only while its bucket still holds a token, and tokens refill at a fixed rate. A naive stateless ACL rate-limits by source IP alone — but a DDoS attacker spoofs a fresh source IP on every packet, so each spoofed packet arrives with a brand-new, full bucket and sails straight through no matter how high the flood. Toggling on stateful inspection (SYN cookies) switches the defence: instead of trusting the IP, the firewall checks whether the TCP handshake actually completes. Spoofed attack traffic never completes it, so it gets dropped at a rate set by the inspection's strictness — independent of how many fake source IPs the attacker rotates through.

stateless ACL:  blocked(attack) = 0            (spoofed IP defeats per-IP limiting)
stateful/SYN:   blocked(attack) = strictness   (handshake-completion check, IP-independent)
serverLoad = (legitAllowed + attackAllowed) / serverCapacity

Legitimate traffic — normal request rate from the real client; always passes the gate, bounded only by its own rate.
Attack intensity — combined request rate across the botnet's spoofed lanes.
Inspection strictness — how confidently the stateful check flags an incomplete handshake as forged; only matters while stateful inspection is on.
Stateful inspection toggle — off models a plain packet-filtering ACL (IP-based, spoof-blind); on models a connection-aware firewall using SYN cookies, the standard SYN-flood mitigation.

Real-world relevance: this is why IP-based rate limiting alone cannot stop a volumetric DDoS — mitigation has to inspect connection state (or use anycast/scrubbing capacity) rather than trust the source address.

Legitimate Attack (in flight) Passed firewall Blocked