In one sentence: an IP stresser is rented traffic-generation capacity — servers (or worse, a botnet) send a chosen volume of packets or requests at an IP you type into a form. Legitimate use means pointing it at infrastructure you own to measure capacity. Everything below explains what's under that form.
1. The three traffic engines
Dedicated servers ("spoooofed-free" floods)
The clean end of the market rents rackspace with fat pipes — a handful of 10/25 Gbps servers can produce honest multi-gigabit floods. This is the model verification-requiring providers use, because clean servers behave predictably and can be audited.
Amplification — borrowed bandwidth
Classic reflection attacks abuse UDP services: send a small spoofed query with the victim's source address to a misconfigured DNS/NTP/CLDAP server, and it answers the victim with a much larger reply — amplification factors historically ranged ~30× (DNS) to ~500× (memcached). Defenders filter these at the edge; that's why modern floods lean on L7.
Botnets — the criminal engine
The cheap panels are fronts for compromised-device networks — IoT cameras, routers, VPS malware. The customer gets a login; the operator rents the same bots to a dozen other customers. This is what the FBI's recurring domain seizures actually dismantle, and why running a "test" through a free panel can write your IP into someone else's criminal evidence.
2. L4 vs L7 — two different weapons
Layer 4: --udp-flood--> [target uplink: Gbps saturated]
--syn-flood--> [state table: conntrack exhausted]
Layer 7: GET /search?q=x x 200,000 rps --> [app workers starved]
TLS handshakes x 40,000 --> [CPU-bound crypto]
Bandwidth floods are measured in Gbps and Mpps. Application floods in requests per second. A hardened edge that shrugs off a 10 Gbps UDP storm can still collapse under a few thousand requests per second of login-form POSTs — the expensive-path problem. Imperva's write-up on booters and Okta's definition of a stresser cover the taxonomy from the defender's side.
3. What "verification" separates
- Ownership-verified panels — require proof you control the target (DNS TXT, file upload, cloud account link). Business model: legitimate testing.
- No-check booters — accept any IP. Business model: attack for hire, frequently re-branded after each seizure wave.
- "Free" panels — IP harvesters, malware droppers, or proof-of-concept honeypots. Assume your traffic and identity are logged for someone else's use.
4. The legitimate counterpart
Security teams reproduce the same measurements without third-party risk: iperf3 for throughput, k6/wrk2 for request load, hping3 for packet-level checks, and cloud load-testing services that generate traffic inside your own project with an audit trail. The output you're after is identical: the load level where latency, loss or error rates first move off baseline — plus which component hit the wall first.
Sources & further reading
- Imperva — Booters, Stressers and DDoSers
- Okta — IP Stresser (Booter): Definition & Uses
- Radware — DDoS Knowledge Center
- US DOJ — FBI Seizes DDoS-for-Hire Domains
- Cloudflare — What is a DDoS attack?