Unlike the reflectors that abuse a protocol still in daily use, a CHARGEN amplification attack revives a diagnostic service from 1983 that no modern system needs and few operators remember running. That is what a thorough DDoS test is checking for when it probes this vector: not a live dependency, but a legacy default still answering on the wire. Like the rest of the amplification attack family it spoofs the victim's address into a tiny UDP request so that third-party hosts flood the victim with a far larger reply.
What makes CHARGEN amplification specific
The Character Generator Protocol, defined in RFC 864, is a test service that replies to any packet on UDP port 19 with a stream of arbitrary characters. It exists purely to generate throwaway data for debugging, so its reply bears no relation to the size of the request that triggered it. A one-byte query provokes a full character payload, and US-CERT's advisory TA14-017A puts the resulting amplification factor at 358.8 times, one of the highest of any reflection vector short of memcached.
The vector has a long lineage. CHARGEN was one of the two services the Fraggle attack targeted in the 1990s, bouncing UDP off port 19 and port 7 the way Smurf abused ICMP, so its abuse predates the modern reflection era entirely. What keeps it alive is not that anyone deploys it deliberately but that it ships enabled in the firmware of old printers, routers, and embedded devices that were configured once and never revisited. The amplification factor is high enough that even a thin population of these forgotten hosts is worth an attacker's time.
Why it matters under attack
The traffic arriving at the victim is well-formed CHARGEN output from real hosts answering exactly as their decades-old code says they should, so there is no malicious sender to block and no signature to filter. The origin link saturates on raw volume before any application ever sees a packet, and the defender is left absorbing bits rather than identifying an attacker.
The fixes sit with other operators. Source-address validation (BCP 38) at the originating networks would stop the spoofed one-byte requests leaving, and disabling UDP 19 on the exposed devices would remove them from the reflector pool. Neither is under the target's control, which is why a service with no legitimate modern purpose still turns up in live floods.
What a DDoS test measures
Because prevention lives on hardware the target does not own, the test measures absorption at the receiving side: how much reflected volume the edge or scrubbing tier swallows before goodput falls, and how long the flood keeps reaching the origin before mitigation engages. The inward-facing question is unusually blunt here, since the answer should always be no: does anything inside your perimeter still answer on UDP 19. Where this sits among the other reflection vectors a test drives together is covered in Understanding DDoS Attack Vectors.