For flood capacity, why rent 100,000 consumer devices over eight high-bandwidth hosts?

## Two products that look like one Everybody's first model of a botnet is "lots of machines, therefore lots of bandwidth". That model is wrong often enough to be the standard wrong answer at middle level. Flood capacity is really sold along two independent axes: - **Throughput**: how many bits per second the supply can emit. - **Source diversity**: how many distinct addresses, in how many distinct networks, those bits come from, and how ordinary each individual flow looks. A supply can be strong on one and weak on the other, and the two shapes are chosen for different jobs. ## The arithmetic that surprises people A compromised server on a well-provisioned link can emit tens of gigabits. Eight of them is a supply in the hundreds of gigabits. A consumer device behind a domestic connection has an *upload* path that is a small fraction of its download path, and in practice a fleet host contributes on the order of a megabit or two, often less, because the herder throttles deliberately to avoid the subscriber noticing a sluggish connection. So a hundred thousand of them may total less than the eight. Fleet size is not a bandwidth number. | Supply shape | Per-host rate | Distinct sources | What it actually buys | Persistence | |---|---|---|---|---| | A few high-bandwidth hosts | Very high | Handful, one or two networks | Raw peak, acquired fast | Short: removable in one decision | | Many consumer devices | Very low | Tens of thousands of networks | Indistinguishability from customers | Long: no cheap way to separate | ## What diversity is actually worth Eight sources in two networks is a *list*. It can be enumerated, and removing it costs the target nothing, because no real customer lives there. The supply is therefore fragile in exactly the way that matters: it survives only as long as it takes to make one decision. A hundred thousand consumer addresses cannot be treated as a list. They live in the same networks the target's real customers live in. Each one is sending at a rate a real customer could send at, so per-source thresholds are under-run by construction; the aggregate is just the sum of a hundred thousand individually unremarkable flows. Any rule wide enough to catch them catches paying users, and that collateral is precisely the cost the attacker is transferring onto the target. The fleet is not sized to overwhelm a link, it is sized so that separating it from the customer base is a decision nobody wants to make. This is also why geographic and network spread is advertised as a feature by resellers, and why a fleet concentrated in one country is worth less against a global service than a dispersed one. ## Why the stock is cheap junk There is a valuation argument underneath the choice. When a compromised host's only asset is its bandwidth, its residual value is close to zero: a megabit of upstream for a few weeks. A supply built from assets worth nearly nothing can only be profitable if acquisition costs nearly nothing, which selects hard for: - devices with default or reused credentials reachable from the internet; - firmware that is never updated and often cannot be; - hardware that is always powered on and unattended, so the host stays available and nobody notices; - populations large enough that the attrition of reboots, replacements and address changes is absorbed by volume. Routers, cameras, recorders and set-top boxes fit all four. Corporate servers do not: they are harder to take, more valuable for other purposes, and their loss is noticed. Choosing them for bandwidth alone would be spending an expensive asset on the cheapest possible use. ## The mix in practice Real operations often combine both. A small set of fat hosts provides an opening peak while the diverse fleet provides the part that does not go away, so the target faces a burst it can absorb followed by pressure it cannot cleanly separate. When you hear a description of a flood, asking "how many distinct sources, and in how many networks" separates these two supplies faster than asking for the peak figure. ## Answering well State the distinction in one line: throughput and source diversity are different purchases. Then give the arithmetic that proves fleet size is not bandwidth, then the collateral argument that explains what diversity buys, then the residual-value argument that explains why the fleet is made of cheap devices. That sequence answers the question and pre-empts the two follow-ups.