A NetBIOS amplification attack is a Layer 4 reflection vector with one of the smallest multipliers in its family, which is exactly why a thorough DDoS test should not skip it: the reason to use it is not ratio but availability. Like every reflection attack, it forges the victim's address onto a small UDP request so that a third-party host sends its reply to the victim. The general case is covered under amplification attack; this page covers what the NetBIOS Name Service adds.
What makes NetBIOS amplification specific
The NetBIOS Name Service, defined in RFC 1002, resolves names on legacy Windows networks and listens on UDP port 137. The query attackers use is the node status request, usually called NBSTAT: a roughly 50-byte packet asking for the wildcard name, to which the host answers with its whole name table. Each registered name costs 18 bytes in the reply, and the reply ends with the adapter's MAC address and a block of statistics.
That fixes the arithmetic. A host with half a dozen registered names returns a few hundred bytes, and US-CERT's advisory TA14-017A rates the vector at about 3.8 times. A host with a single name barely breaks even. Compared with the hundreds that NTP or CHARGEN deliver, NetBIOS is a weak multiplier on any one host, and it earns a place in attack tooling by being answered on a large number of forgotten Windows machines and NAS boxes that still run NetBIOS over TCP/IP on a public interface.
The reply also gives away information. A node status answer lists the machine's hostname, its workgroup or domain and its MAC address, so a host that reflects NetBIOS is simultaneously publishing a small inventory of itself to anyone who asks. Akamai's researchers reported NetBIOS name-service reflection in live attacks in 2015, alongside portmapper, and it has stayed in the reflection toolkits since as a filler vector rather than a headline one.
Why it matters under attack
On its own, a NetBIOS flood is rarely what takes a site down. Its role is dilution: added to a multi-vector attack it contributes volume from a population of reflectors that is different from the DNS and NTP servers, so mitigation that keys on the dominant vector lets it through.
It is, however, one of the easiest vectors to strip out. No legitimate internet service sends you UDP from source port 137, so an upstream filter on that source port removes the whole vector with no collateral. The test question is whether that filter exists at the provider edge rather than on the firewall behind a link that has already filled. Stopping the forged requests at their point of origin depends on BCP 38 being applied by other networks.
What a DDoS test measures
For the inbound side, a test drives reflected NBSTAT-shaped traffic within a larger mix and checks whether the source-port rule engages and how much legitimate UDP is affected when it does. For the outbound side the question is blunt: does anything in your address space answer a node status request from the internet, and if so, what hostname and domain does it reveal. Both answers should be short. What that means for choosing where volumetric absorption happens is worked through in AWS Shield vs Cloudflare DDoS Protection.