Sometimes it's less about the size of the payload and more about # of requests. Especially when targeting the application layer.

Read more here: https://www.imperva.com/blog/gbps-pps-rps-ddos-attacks/#:~:t...