What is Reflective DDoS?

A reflective DDoS (distributed denial-of-service) attack, also known as an amplification attack, is a cyberattack that exploits publicly accessible servers to overwhelm a target with amplified traffic. The attacker sends small, spoofed requests to misconfigured services such as DNS, NTP, or SNMP. These services, instead of verifying the source address, send large responses to the victim's IP address, effectively multiplying the bandwidth consumed. This technique allows attackers to generate massive attack volumes with limited resources.

How it works: The attacker forges the source IP address of the request to match the victim's IP. The server receiving the request sends its response to that forged address. The response is many times larger than the request, creating an amplification factor. For example, a DNS query of 60 bytes can produce a response over 4000 bytes, a factor of 70. The attacker distributes the attack across many servers (often thousands) to create a flood. The victim's network devices or servers become saturated, causing denial of service.

Where it fits: Reflective DDoS attacks are a subset of DDoS attacks that exploit network protocols without authentication. They are harder to mitigate than direct attacks because the traffic originates from legitimate servers. Defenses include BCP 38 (ingress filtering to block spoofed packets), rate limiting, and using DDoS protection services. They are part of the larger category of amplification attacks, which also include attacks on protocols like Memcached and SSDP.