Dstat monitoring vs Load testing — Dstat comparison

Dstat monitoring

• Observes live traffic and protection effectiveness.
• Breaks down passed / bypass / blocked.
• Focused on how defenses respond.

Load testing

• Measures capacity and latency under load.
• Focused on application performance limits.
• Usually run against your own staging.

Different questions, different metrics

A load test answers how much the application can serve before latency or error rate becomes unacceptable. Its outputs are throughput, response time percentiles and error counts, measured from the client side against a known request mix.

A Dstat answers how much hostile traffic is reaching the origin and how much the protection layer is removing. Its outputs are incoming requests per second and the passed / bypass / blocked split, measured at the target while traffic is arriving. A Dstat does not report latency, and a load test does not report what a WAF filtered.

Using both in one exercise

Run the load test first against staging with protections disabled to establish the application's capacity ceiling. This number is the reference for everything that follows: if the origin can serve 2,000 RPS, any bypass above that on a live Dstat means the protection is not sufficient.

Then run the Dstat against the protected target and read the bypass line against that ceiling. The protection is doing its job when incoming traffic exceeds capacity while bypass stays below it. Repeating the pair after each configuration change shows whether a rule improved filtering or only shifted load.

Takeaway

Use load testing to find capacity limits, and Dstat to verify that protections actually filter hostile traffic.