All DDoS Definitions
DDoS Testing Definition

Amplification Factor

Amplification factor measures how many bytes of response a reflector returns for each byte of request it receives. Under attack that ratio is what turns a modest uplink into a volumetric flood, which is why a DDoS test reports it alongside the bits-per-second a given pool of reflectors can actually deliver. It is the defining measure of an amplification attack: the higher the factor, the less bandwidth an attacker needs of their own.

Amplification factor: tiny query, huge answer Attacker spoofs victim IP small query Reflector open resolver, NTP, memcached answers on UDP reflected answer Victim link saturates 1 unit of request in up to 50,000x out memcached on UDP 11211 Amplification factor = response size / request size; a higher factor means less attacker bandwidth is needed. BlackNeuron™
Diagram of amplification factor: a small spoofed query to a reflector returns a response up to tens of thousands of times larger at the victim

How the number is defined and what it reaches

The factor is response size divided by request size for a single reflected exchange. Because the request carries a spoofed source address, the oversized reply lands on the victim rather than the sender, so the ratio translates directly into free bandwidth aimed at a target.

Published measurements vary by protocol and span a wide range. An open DNS resolver typically returns somewhere between 28x and 54x. NTP's monlist command has been measured near 556x. CLDAP sits around 56x to 70x, chargen near 358x, SSDP around 30x, and memcached on UDP 11211 is the extreme case, measured above 50,000x because a small get can pull back hundreds of kilobytes. Those are the numbers that decide which exposed services carry the most reflection risk if left reachable.

It is worth separating two forms of the metric. The bandwidth amplification factor compares byte sizes and predicts link saturation; the packet amplification factor compares packet counts and predicts pressure on packets-per-second-bound devices, since one request can trigger several response packets. A vector can be dangerous on one axis and unremarkable on the other, so a test that only watches bits per second can miss a packet-rate problem entirely.

Amplification factor: one small spoofed request, a far larger reply at the victim request 15 bytes 15 bytes open reflector e.g. memcached UDP 11211 up to 51,000x reflected response victim spoofed source, so the oversized reply lands on the victim, not the sender BlackNeuron™
Animated amplification factor: a tiny spoofed request enters an open reflector and a far larger response is flung at the victim, the ratio of the two being the whole of the metric

Why it matters in DDoS testing

Amplification factor predicts the bits per second a known pool of reflectors can produce, which sets the volumetric ceiling a test should provision toward and the scrubbing capacity a defender should size against. It also ranks exposure: the same scan that finds your reachable DNS, NTP, or memcached services tells you which of them an attacker would reach for first.

The structural defense is source-address validation (BCP 38) at the carrier level, which denies the spoofed requests before any reflection can happen, but its uneven deployment is why these vectors persist. A test therefore characterizes whether ingress filtering actually drops spoofed source traffic on your own paths, and how much reflected volume the edge absorbs before clean traffic degrades. What that ceiling means for the capacity decisions a defender actually has to make is worked through in DDoS resilience testing.