How exactly does reflective amplification work to create massive DDoS floods?

Question

I've been reading about some of these record-breaking DDoS attacks in the news, and they often mention 'reflective amplification' as the technique. I understand the basics of a regular DDoS, but I can't wrap my head around how this specific method generates such an insane amount of traffic. I've tried looking at some technical summaries, but they get into the weeds on protocols like DNS or NTP without explaining the core amplification trick. Could someone break down, in simple terms, the step-by-step process an attacker uses to turn a small query into a huge flood of traffic directed at a target?

admin · Accepted Answer

Reflective amplification works by tricking public servers into sending massive responses to a small forged request, flooding a victim with traffic. Attackers spoof the victim's IP address as the source when sending small queries to numerous publicly accessible servers (reflectors) that respond with much larger replies. This exploits the fundamental asymmetry in certain network protocols where a tiny query can trigger a disproportionately large response. The amplification factor - the ratio of response size to request size - is key, with protocols like DNS, NTP, or CLDAP offering factors from 10x to over 5000x. By leveraging botnets to send countless spoofed requests to reflectors, attackers multiply their output into a devastating traffic flood directed at the target.

For example, a tiny 60-byte DNS query for a large zone transfer can trigger a 4000-byte response:

dig ANY isc.org @9.9.9.9

Attackers configure their tools to spoof the source IP:

hping3 --udp -a 192.0.2.1 --data 60 -p 53 9.9.9.9

The core vulnerability lies in protocols that respond publicly without requiring a prior connection or validating the source address, enabling this asymmetric abuse.

For example, a tiny 60-byte DNS query for a large zone transfer can trigger a 4000-byte response:

dig ANY isc.org @9.9.9.9

Attackers configure their tools to spoof the source IP:

hping3 --udp -a 192.0.2.1 --data 60 -p 53 9.9.9.9

The core vulnerability lies in protocols that respond publicly without requiring a prior connection or validating the source address, enabling this asymmetric abuse.

How exactly does reflective amplification work to create massive DDoS floods?

Who Is Online