Authorized Network Testing
Layer7 measures the application. The Layer4 tab in the same panel measures the packet path, and the two never answer the same question.
Authorized testing only - you must own or have explicit permission to test.
Hub, then the Layer7 section. A URL takes the place of the IP address, and a time in seconds plus a method follow. The moment the test starts, live metrics refresh on the same screen. The tab is open on free accounts with no locked methods; window length is what the free tier trims, and paid plans reach 5000 seconds.
GET and POST floods drive request volume. A slow body holds worker slots open without finishing the request. TLS handshake churn exposes crypto cost. Each method attacks a different queue, so each produces a different curve. Running two at once collapses two behaviours into one average, and the first test is most readable with GET.
Requests per second, response ratio, latency and the error-code split. Packet loss is invisible here, and the DDoS stresser tab measures it in packets per second. A site can be flawless at packet level and still fall over at 300 requests per second on checkout, which is exactly the gap this page fills.
PHP-FPM or Node workers, then database connections, then anything calling a third party. A twenty-worker install stops at twenty concurrent requests rather than at a round number. MySQL ships with max_connections at 151, and a pool that opens one connection per request reaches that limit long before the CPU looks busy. Both limits are configuration, which is why the fix is often an afternoon.
Start with request rate: flat through the run or sliding down. Then the response ratio and latency. Ratio falling while latency climbs means the application is queueing. A 500 points at the application, a 502 or 504 at the proxy in between, a 429 at a rate limit doing its job. Without that split, "the site was slow" is the only sentence available.
JavaScript, signed-in sessions and the payment provider. A real checkout validates the card in the browser, redirects to 3D Secure and returns through a webhook, none of which sits in your request path. Flows that need a cart or a session also need a script, and the website stresser ordering of pages is a starting point rather than a substitute.
k6 or Playwright scripts a path: login, search, cart, pay, with think time between steps. A stresser holds one endpoint at a fixed rate and reports the point where it stops answering correctly. Use both in order, script first to prove the flow, stresser second to find the ceiling of a single endpoint.
Comparability needs the same target, method and window; if only the date changed, you have a regression test. The stresser panel stores those fields with the run. The cheapest first pass is the free stresser tier, free L7 stresser runs the HTTP-only version, and IP stresser free builds the same record at packet level.
Layer 4 moves packets and measures the network path; layer 7 sends HTTP requests and measures the application.
20+ Layer7 methods, one chosen per test.
There is no general number. A cached endpoint can serve tens of thousands; a checkout writing to three tables can struggle past a few hundred.
No. Only systems you own or have written permission to test.
Mostly the edge while the cache is warm. Bypass the cache to reach the origin.
Short on the free tier, up to 5000 seconds on paid plans.
Trial credit from live support or the $0 Basic plan, same panel and same method list. The report matches what the paid plans produce.