Amplification DDoS: small packets, big damage

Amplification abuses UDP protocols where a small request yields a large response, and the lack of a handshake allows spoofing the source IP.

How it works

The attacker sends requests with source IP = victim to open servers (DNS, NTP, memcached, SSDP). The servers reply to the victim with much larger answers. The amplification factor ranges from ~50x (DNS) to ~50000x (memcached).

# NTP monlist: ~8-byte request -> >400-byte reply
# memcached: a few bytes -> megabytes

Defence

Provider side: BCP38 (anti-spoofing, filtering forged-source traffic). Service side: do not expose recursive DNS/NTP monlist/memcached to the Internet, rate-limit responses. Victim side: upstream scrubbing/anti-DDoS, adequate network capacity.