A DDoS amplification attack is a type of reflection attack in which small requests with a spoofed source address make third-party servers send much larger responses to the victim, multiplying the attacker’s bandwidth.
How amplification attacks work
The attacker sends queries over UDP – which does not verify the sender – to thousands of publicly reachable servers, forging the victim’s IP address as the source (spoofing). The servers reply to the victim, and each reply is many times larger than the request. The ratio is called the amplification factor. Commonly abused protocols include:
- DNS – open resolvers answering large queries such as ANY or DNSSEC records;
- NTP – the old
monlistcommand, with factors of several hundred; - Memcached – exposed caching servers with factors of tens of thousands;
- SSDP, CLDAP, SNMP, CharGEN and some UDP-based VPN and gaming services.
Why amplification matters
Amplification lets a small botnet or a single rented server generate traffic floods of hundreds of gigabits per second, and hides the attacker behind innocent reflectors. In February 2018, GitHub was hit by a 1.35 Tbps attack using exposed memcached servers – a record at the time. Amplification remains a staple of DDoS attacks sold by “booter” and “stresser” services, alongside botnet floods.
How to defend against amplification attacks
- Network operators should block spoofed traffic with ingress filtering (BCP 38, RFC 2827).
- Do not expose DNS resolvers, NTP, memcached or SNMP to the internet; disable legacy commands and apply response rate limiting.
- Use DDoS scrubbing services or a CDN with enough capacity to absorb volumetric floods.
- Prepare an incident plan with your ISP, including upstream filtering of the abused ports.
