An amplification attack is a volumetric attack vector, one of the bandwidth-exhaustion classes a thorough DDoS test is built to exercise. The attacker sends small requests to third-party servers whose responses are far larger than the query: open DNS resolvers, NTP daemons, memcached nodes, and CLDAP services all answer with payloads many times the size of the request. The source address is spoofed to the victim's IP, so every oversized reply is delivered to the target rather than the sender. The defining measure is the amplification factor, the ratio of response bytes to request bytes; with high-factor protocols a few megabits of outbound query traffic can generate hundreds of gigabits at the victim. Amplification is what lets a modestly-resourced attacker produce terabit-scale volume without a large botnet.
Why it matters in DDoS testing
Amplification is why volumetric attacks reach magnitudes no origin link can absorb, so the test that matters is one of upstream capacity, not origin tuning. A DDoS test characterizes how much reflected volume the edge or scrubbing tier absorbs before clean traffic degrades, and how quickly mitigation engages once the flood begins. The structural fix is source-address validation (BCP 38) at the carrier level, but its uneven deployment is why these attacks persist, so testing focuses on absorption and cutover latency rather than prevention. The mechanics of each amplifying protocol are covered in Understanding DDoS Attack Vectors.