# Reflection and Amplification Attacks: The Complete Technical Guide

> Reflection attacks use third-party servers as unwitting amplifiers. Understanding the mechanics — and the mitigation — across all major protocols.

- Category: Technical Deep Dive
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/reflection-amplification-overview

---

Reflection and amplification attacks are a class of DDoS attack where the attacker exploits protocol behavior to generate massively disproportionate traffic at a target — using third-party servers that are completely uninvolved in the attack. They require no botnet and no sustained bandwidth: a modest attacker can generate terabits from a home connection.

## The Core Mechanism

Both components work together. Reflection means traffic appears to come from a legitimate server, not the attacker. Amplification means the response is much larger than the request — sometimes thousands of times larger. Together, they give attackers massive leverage with minimal resources.

## Major Reflection/Amplification Protocols

- DNS (UDP/53): 28–54x amplification. Widely exploited.
- NTP (UDP/123): up to 556x via MONLIST command. Older but still in use.
- Memcached (UDP/11211): up to 51,000x. The highest known amplification factor.
- SSDP (UDP/1900): 30x. Used in Mirai-based attacks.
- CLDAP (UDP/389): 56–70x. Targets Windows LDAP services.
- WS-Discovery (UDP/3702): 300–500x. Newer attack vector targeting IoT.

## Why IP Spoofing Makes This Possible

All reflection attacks depend on UDP source address spoofing. The attacker sends a packet claiming to be from the victim's IP; the amplifier sends its large response to that IP. Networks that implement BCP38 ingress filtering block spoofed packets — but a significant fraction of the internet's networks do not.

## Mitigation at the Proxy Layer

Amplification is a network-layer (L3/L4) flood, so it is stopped upstream — at your host or transit provider's network, ideally with BCP38 source-address validation. Akarguard is an L7 reverse proxy: it does not scrub UDP, but by hiding your origin IP it removes the direct target, so a reflected flood has nowhere to land and your server keeps serving legitimate users.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.