DDoS Amplification
What is DDoS Amplification?
DDoS AmplificationA DDoS technique that abuses UDP-based services to reflect responses many times larger than the spoofed request, allowing small attackers to generate massive flood volumes.
Amplification (or reflection) DDoS attacks exploit Internet services that respond to a small UDP query with a much larger reply. The attacker sends queries with the victim's IP spoofed as the source, causing reflectors to send huge responses to the victim. The amplification factor — the ratio between response size and request size — can range from a few times (NTP MONLIST), to dozens (DNS ANY, SSDP), to thousands of times (memcached, the previous record-holder). This makes it possible to generate terabit-class attacks from comparatively modest infrastructure. Mitigation includes source-address validation (BCP 38/RFC 2827), disabling or restricting abusable services, rate-limiting reflectors, and DDoS scrubbing services that can absorb amplified traffic.
● Examples
- 01
An attacker spoofs the victim's IP and sends DNS ANY queries to thousands of open resolvers, which flood the target with large responses.
- 02
Memcached servers exposed to the Internet are abused to deliver attacks with amplification ratios above 50,000×.
● Frequently asked questions
What is DDoS Amplification?
A DDoS technique that abuses UDP-based services to reflect responses many times larger than the spoofed request, allowing small attackers to generate massive flood volumes. It belongs to the Attacks & Threats category of cybersecurity.
What does DDoS Amplification mean?
A DDoS technique that abuses UDP-based services to reflect responses many times larger than the spoofed request, allowing small attackers to generate massive flood volumes.
How do you defend against DDoS Amplification?
Defences for DDoS Amplification typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for DDoS Amplification?
Common alternative names include: Reflection DDoS, Amplification attack.