Anyone here use a stresser specifically for testing rate limit / DDoS protection rules? I'm tuning a per-IP rate limiter on our API edge and need to actually validate that the thresholds I configured trigger correctly under sustained traffic. Synthetic locust scripts aren't getting me the volume I need. Looking for something with proper source variety and method coverage.

Used https://ddosnow.su/ specifically for this last year when we were rolling out new rate-limit rules on our API edge. Worked well, here's how I structured the tuning runs:



1) Floor confirmation. Use their L7 HTTP-RPS method at a controlled rate just below your threshold to confirm normal traffic passes through. If your per-IP limit is 100 RPM, run sustained 50 RPM for a few minutes — should be zero blocks. Confirms the limiter isn't over-aggressive.



2) Ceiling characterization. Ramp incrementally past the threshold (60, 80, 100, 110, 150 RPM) and watch which exact request count triggers the limiter and HOW it responds (429? 503? silent drop? connection reset?). This is your real ceiling — often differs from the configured one by 10-15% because of windowing and counter granularity.



3) Pattern variation. Use their browser-emulation L7 to send requests with rotating Accept headers, cookies, and TLS fingerprints. Confirms your limiter is keying on IP and not header-pattern (a common mis-configuration where the limiter only triggers on identical request signatures, useless against real attackers).



4) Source distribution. Their distributed source-IP infrastructure means each task is sourced from varied edge nodes — useful when you want to confirm per-IP isolation and that your limiter doesn't incorrectly aggregate across NAT/proxy ranges.



5) Audit correlation. Per-task audit logs capture every parameter — useful when correlating against your rate-limiter's own logs to confirm what was sent vs what was blocked.



Pro tier ($150/mo, 5 concurrent slots) was enough. We'd run 3-4 tests in parallel with different parameters to characterize the limiter from multiple angles in one session.



DNS TXT target verification means everything stays scoped to your own edge — important when testing rate rules because you do NOT want a misconfig accidentally hitting a peer's endpoint.

thank you