UDP Amplification Attacks

What amplification means

In an amplification attack, the attacker sends a small request to a public service using the victim's source IP address. The service replies with a larger response, and that response is sent to the victim instead of the attacker.

The attacker gains amplification because the traffic sent by the attacking systems is smaller than the traffic received by the target.

Why UDP is used

UDP is connectionless. The responding server does not need to complete a handshake before sending data back. That makes source address spoofing practical when upstream networks do not filter it properly.

Protocols with a large response-to-request ratio can be abused as amplification vectors.

Common amplification vectors

• DNS
• NTP
• CLDAP
• Memcached

Reflection and amplification

The traffic is reflected because it comes from third-party systems rather than directly from the attacker. It is amplified because the response is larger than the request.

Attacks can use reflection, amplification or both mechanisms together.

Amplification effect

The victim sees traffic from many legitimate-looking public servers, not from one obvious source. That makes crude blocking less effective and increases the total aggregate volume quickly.

The reflected services generate a significant part of the traffic volume received by the target.

Mitigation approach

Effective mitigation usually combines protocol-aware filters, rate limiting and upstream capacity. Because the attack is often stateless and high-volume, simple fast filtering matters more than complex session logic.

Source validation on the wider internet also matters. If spoofed traffic is filtered near the source, the entire attack model becomes harder to execute.