Amplification Attack

An amplification attack is a type of DDoS attack in which an adversary floods the victim with a huge amount of traffic while sending very little themselves. The trick is that the attacker abuses publicly reachable servers (most often running the UDP protocol) as amplifiers. They send small requests to these servers but forge the sender address, putting in the victim’s address instead. The servers dutifully reply, only with much larger packets, and send them not to the attacker but to the victim. How many times bigger the response is than the request is called the amplification factor.

How does an amplification attack work?

Two mechanisms come together here: reflection and amplification. Reflection means the traffic does not go to the victim directly but “bounces” off ordinary, legitimate servers that act as intermediaries (reflectors). Amplification simply means the response is larger than the request. For this to work, the attacker has to be able to impersonate the victim’s IP address. That is why these attacks almost always rely on UDP — a connectionless protocol that does not check who actually sent a request (unlike TCP, where a so-called handshake first confirms both the sender and the receiver).

1. Find reflectors. The attacker scans the internet for misconfigured, open services: open DNS resolvers, NTP servers with the monlist command enabled, Memcached instances listening on UDP, or SSDP/SNMP devices.
2. Forge the sender address. The source address field of the outgoing packets is swapped for the victim’s address (IP spoofing). This is possible when the network along the way does not filter outbound traffic (no BCP38).
3. Send small requests. Usually with a botnet, the attacker sends short requests to thousands of reflectors, crafted to trigger the largest possible response (for example a DNS query for record type ANY).
4. Reflect and amplify. Each reflector sends a response — many times larger than the request — to the forged address, that is, to the victim.
5. Exhaust the link. Traffic from many reflectors adds up and clogs the victim’s bandwidth or resources, so it can no longer serve normal traffic.

What is the amplification factor?

The amplification factor indicates how many bytes of response traffic reach the victim for each byte of request traffic sent by the attacker. The higher the factor, the less effort the attacker needs to generate a large volume of traffic. For DNS, the amplification factor can range from several to several dozen times, and in favorable configurations may reach around 50x or more. For example, a DNS query of around 60 bytes can trigger a response exceeding 3,000 bytes, resulting in an amplification factor of approximately 50. Approximate values for common attack vectors include:

• DNS — typically from several to several dozen times, and in favorable configurations around 50x or more.
• NTP (the monlist command) — about 50–500x.
• SSDP — around 30x.
• SNMP — several hundred times in unfavorable configurations.
• Memcached — extremely high; reported factors on the order of 10,000–51,000x (CISA alert, 2018).

These values depend on the protocol, the reflector’s configuration and the request payload, so they should be treated as orders of magnitude rather than fixed numbers.

How does reflection differ from amplification?

These are two different ideas, even though they usually go hand in hand. Reflection is about hiding the attacker: traffic reaches the victim “bounced” off neutral servers, so it is hard to tell who is really behind the attack. Amplification is about scale: the response is larger than the request, which multiplies the force of the strike. Reflection without much amplification is possible (a simple packet bounce), but in practice volumetric attacks use both effects at once. This combination is sometimes called a DRDoS (Distributed Reflection Denial of Service) attack.

Most common amplification attack vectors

• DNS amplification — abuse of open DNS resolvers; queries for records that produce large responses (for example type ANY, DNSSEC) on port 53/UDP.
• NTP amplification — abuse of the monlist command on outdated NTP servers (port 123/UDP), which returns a list of recent clients.
• Memcached amplification — abuse of Memcached instances exposed to the internet on port 11211/UDP; the source of record-breaking attacks in 2018.
• SSDP amplification — abuse of the UPnP/SSDP protocol (port 1900/UDP) in unsecured home and IoT devices.
• SNMP / CLDAP / CharGen — older UDP services that also act as reflectors when improperly exposed.

Why do amplification attacks matter for security and network monitoring?

From a defender’s point of view, amplification attacks are dangerous for three reasons: the attacker works with little effort, their address is hidden behind reflectors, and the traffic itself looks like ordinary, legitimate protocol responses. For SOC teams and network monitoring systems (NDR, NetFlow/IPFIX, sFlow), the key is catching volumetric anomalies in flow telemetry — a sudden surge of traffic from specific UDP source ports (such as 53, 123, 11211, 1900) aimed at a single address or subnet. Telltale signs include a lot of responses that no request preceded and an unusually high number of bytes per packet. Importantly, an organization can be not only a target but also an unwitting reflector — so monitoring should also detect outbound traffic that betrays abuse of its own services.

How can the risk of amplification attacks be reduced?

1. Outbound traffic filtering (BCP38 / source address validation). Operators and enterprises should drop outgoing packets with a spoofed sender address — the basic control that cuts off spoofing at the source.
2. Closing and hardening open services. Disable DNS recursion for unauthorized clients, update NTP (remove monlist), and cut Memcached and SNMP off from the public internet.
3. Response Rate Limiting (RRL) on DNS servers, that is, capping the number of identical responses sent to a single address.
4. Rate limiting and filtering at the network edge. Per-IP/subnet rate limits, ACLs, and blocking unexpected UDP responses at the border.
5. Scrubbing and anti-DDoS protection. Redirecting traffic through scrubbing centers and mitigation services that absorb the attack volume.
6. Monitoring and early detection. Flow telemetry analysis and anomaly detection to spot an attack (and any abuse of your own infrastructure) before it saturates the link.

Learn more

• HTTP Flood — HTTP floods can be amplified when bots trigger many requests at a target.
• Reflection Attack — Reflection attacks use third-party servers to bounce and magnify traffic toward a victim.
• Scrubbing Center — Scrubbing centers filter amplified attack traffic before it reaches the target.