What is an amplification attack?
An amplification attack is a type of distributed denial-of-service in which the attacker turns a little outbound traffic into a flood aimed at someone else. It leans on two facts about certain UDP services: they answer without a handshake, and the answer can be far larger than the question. By forging the source address on each request so it reads as the victim's address, the attacker makes thousands of innocent servers mail their oversized replies to one target at once.
Reflection and amplification are two parts of one trick
Reflection is the misdirection: because UDP never confirms who really sent a packet, a server that receives a request with a spoofed source simply replies to that spoofed address. The traffic that hits the victim therefore appears to come from legitimate third parties, not from the attacker's machines, which makes filtering by source pointless. Amplification is the multiplier on top of reflection, and it is measured as a bandwidth amplification factor, the ratio of reply size to request size. The larger that ratio, the fewer bots the attacker needs.
The services that get abused
A handful of exposed UDP services have done most of the damage:
- DNS on port 53: an open resolver asked for a large record set returns a response many times the size of the query.
- NTP on port 123: a deprecated monitoring request on old servers returns a long list of recent clients, a factor of a few hundred.
- Memcached on port 11211: caching servers left reachable from the internet have produced some of the highest ratios ever seen, into the tens of thousands, and powered a 1.35 Tbps flood against a code-hosting site in 2018.
How to defend against it
Defense splits between the target and everyone who runs the reflectors. A victim usually cannot absorb the volume alone, so it relies on an upstream provider or a content delivery network to scrub the flood before it reaches the link. Operators of the abused services shrink the problem by not exposing resolvers, time servers and caches to the open internet. The root cure is address spoofing itself: when network operators drop packets arriving from customer networks with source addresses those networks don't own, the ingress filtering described in BCP 38, the forged requests never leave, and reflection has nothing to work with.
Amplification attack on the CompTIA Security+ exam
This attack is one of the denial-of-service indicators under SY0-801 objective 2.5, which asks you to read a scenario and name the malicious activity. The giveaway wording is a target drowning in responses from servers it never contacted, usually all from the same well-known UDP port. Separate it from a direct flood sent straight from the attacker's bots with no reflectors, and from a protocol attack such as a SYN flood that exhausts connection state rather than bandwidth. If the question asks what removes the spoofing the attack depends on, the answer is source-address filtering at the network edge.