Bridge WAF
Bridge CDN →

Amplification attacks: other people's servers, your victim's link

A reflection attack sends requests to servers on the internet with the victim's address forged as the source, so the servers send their replies to the victim. An amplification attack picks services whose replies are much larger than the requests, so every byte the attacker sends turns into many bytes arriving at the victim. Together they let a modest botnet fill very large links.

Section Attack types Updated Needs spoofing + open services

Quick facts

Reflection
Replies are sent to a forged source address: the victim
Amplification
Each reply is larger than the request that caused it
Protocol
Almost always UDP, which needs no handshake
Typical services abused
Time servers, memcached, DNS resolvers and other UDP services left open
Root causes
Networks that allow spoofed sources (BCP 38) and services that answer anyone

The general problem is described in RFC 4732; individual vectors have their own pages below.

How a reflected, amplified DDoS attack works

  1. The attacker finds open services. Servers that answer UDP queries from anyone on the internet.
  2. It sends them small queries with a forged source. The source is the victim's address; see IP spoofing.
  3. The services reply to the victim. Each reply is many times the size of the query.
  4. Thousands of services reply at once. The victim's link fills with traffic from servers that look entirely legitimate.

The victim sees traffic from real, reachable servers, not from the attacker. Blocking those servers one by one is slow, and some of them may be services the victim also needs.

WHAT REFLECTION ADDS TO A FLOOD REFLECTED AMPLIFIED SOURCES LOOK LEGITIMATE NTP MEMCACHED DNS PLAIN UDP FLOOD // the last row is the attacker's own traffic, sent directly
// three reflection vectors compared with a direct flood

Common amplification vectors

  • NTP. Time servers that answer status queries with long lists; see NTP amplification.
  • Memcached. Caching servers exposed to the internet over UDP; behind the 1.35 Tbps attack on GitHub in 2018 (GitHub). See memcached DDoS.
  • DNS. Open resolvers answering large queries; DNS amplification is covered on Bridge DNS, the naming layer of the network.
  • Other UDP services. Device discovery, directory and chat protocols left reachable from the internet.

What an amplification attack looks like from the receiving end

Traffic arrives from thousands of addresses that all belong to real servers, all sending from the same service port, such as the port of a time or caching service. The packets are replies to questions you never asked, so there is no matching outbound traffic from your side.

Because the packets are large and arrive together, the link fills long before your servers are busy. Graphs from your provider show the inbound side at capacity while CPU and request rates on your servers stay normal or fall, since real requests can no longer get through.

How amplification attacks are stopped

At the victim, only capacity in front of the link helps: the provider or an edge network absorbs or filters the flood before it arrives. Because the traffic is UDP from known service ports, it is comparatively easy to recognise; the difficulty is volume.

Across the internet, the attacks are prevented at their two sources: networks that drop packets with forged sources (BCP 38) and operators who close or restrict services that answer anyone. Every server you take off the open internet is one fewer amplifier.

Making sure your servers are not amplifiers

  1. List UDP services reachable from the internet. Scan your own address ranges from outside.
  2. Close what does not need to be public. Memcached, management protocols and discovery services rarely do.
  3. Restrict the rest. Answer only your own clients, and disable query types that return large lists.
  4. Watch outbound traffic. A sudden rise in replies to many destinations is a sign a service is being used.

Questions

What is an amplification attack?

An amplification attack sends small requests with a forged source address to services whose replies are much larger, so the replies flood the victim with far more traffic than the attacker sent.

What is the difference between reflection and amplification?

Reflection means replies go to a forged victim address instead of the sender. Amplification means each reply is larger than the request. Most such attacks use both.

How do you stop a reflected DDoS attack?

The victim needs capacity or filtering upstream of its link. Across the internet, the fix is source address validation by networks and closing services that answer anyone.