When a reply from UDP port 19 hits a border router and is discarded before any firewall, load balancer or application spends a cycle on it, the defender sees a counter tick up and nothing else. That is an ACL (access control list) doing its job, and which attack traffic it really stops is one of the first things a DDoS test checks. An ACL is a network-layer defensive control that permits or denies packets by matching header fields such as source and destination IP, port and protocol, enforced at a router, a firewall, or a cloud network boundary. It is stateless and evaluated in order: the first matching rule decides, and a packet that matches nothing falls through to an implicit deny.
How it filters, and what that costs
Statelessness is the whole appeal. Unlike a stateful firewall, an ACL allocates nothing per connection, so there is no table for a flood to fill. On a hardware router the rules sit in TCAM and are matched at line rate whatever the packet rate.
Reflection traffic is where that shines. A reflected response carries the abused service's port as its source port, so deny udp any eq 19 any drops chargen reflection, and the same pattern works for NTP on 123, SSDP on 1900 or memcached on 11211, provided nothing legitimate is expected from those ports.
The price is that the ACL knows nothing about conversations. Return traffic for your own outbound connections has to be permitted explicitly, usually as a broad range of high ports, and an attacker who aims at that range is let straight in.
Software ACLs carry a second cost. A list of plain iptables rules is evaluated top to bottom for every packet, so a long blocklist added in a hurry during an incident costs CPU per packet in proportion to its length. Set-based matching (ipset, nftables sets) turns that into a hash lookup.
Where ACLs fail under attack
Reach is the first limit. An ACL on your own edge router runs after your upstream circuit. If a flood exceeds the link, the ACL drops the attack correctly and the link is still full. The same rule has to be pushed into the provider's network, by request or through BGP Flowspec, to matter.
Fragments are the second. Only the first fragment of a datagram carries the UDP header, so a port-based rule cannot match the rest. Large amplified responses, memcached and DNS among them, are often fragmented, and an ACL written only on source ports lets the trailing fragments through unless it also handles fragments explicitly.
Then the operational traps. A broad permit placed above a specific deny shadows it, so the deny never matches. Hardware rule space is finite. Cloud network ACLs have small default rule quotas (AWS allows 20 inbound rules per network ACL by default), which a growing blocklist reaches quickly. And adding a log keyword to a deny rule can send matching packets to the router's CPU, turning a cheap drop into an expensive one during exactly the flood it was meant to absorb.
What a DDoS test measures
A test confirms behaviour rather than configuration. For each vector it sends, it reads the per-rule hit counters to check that the rule meant to match is the one that did, which catches shadowing and typos that a config review misses.
It sends fragmented amplification traffic to see whether the trailing fragments get through. It measures where the drop happens: on your own router, after the link has already carried the load, or upstream where it protects the link. And it watches router CPU during the flood, because an ACL that drops correctly at the price of the control plane has not really held.
Which vector families those rules are written against is covered in Understanding DDoS Attack Vectors.