All DDoS Definitions
DDoS Testing Definition

Reflection Attack

A reflection attack works by forging the victim's address onto requests sent to unwitting public servers, so every reply those servers generate lands on the victim instead of the attacker. It is one of the spoofing-based classes a thorough DDoS test is built to exercise, and it names a whole family of vectors by a single property: the traffic that hits the target is legitimate infrastructure answering a question the target never asked.

Reflection: spoofed requests bounce off innocent servers onto the victim Attacker spoofs source IP = victim's address reflectors (innocent third parties) Open DNS resolver answers any source NTP server monlist / large reply UDP service unauthenticated Victim flooded with unrequested replies spoofed requests (src=victim) replies bounced to the victim The attacker's real IP never appears in the traffic the victim receives; every reflector is a legitimate server. A DDoS test measures whether the edge absorbs high volumes of unsolicited reply traffic and how fast scrubbing engages. BlackNeuron™
Reflection attack: an attacker spoofs the victim IP and sends requests to many innocent reflector servers, which each bounce their replies onto the victim while the attacker stays hidden

How reflection works

It exploits any service that answers a request without first checking who asked. A server speaking UDP never confirms who actually sent a query, because there is no handshake binding the conversation to a real source address. It replies to whatever address is written in the packet. Put the victim's IP in that field and the reply is redirected: the attacker's real machine is never in the path the victim can see.

That indirection is the whole point, and it is a separate property from amplification. Amplification is about magnitude, the size gap between a small request and a large reply. Reflection is about direction and concealment: bouncing traffic off a third party so the victim, and anyone doing forensics afterwards, sees thousands of unrelated servers rather than a source. In practice most public UDP services do both, which is exactly why people blur the two words together; keep them apart and reflection is the how-it-hides half, amplification the how-big-it-gets half. Reflection with a factor near one still hides the attacker even when it multiplies nothing.

Not every reflector is a UDP amplifier. TCP carries its own variants: a SYN sent with a spoofed source draws a SYN-ACK back at the victim, and in 2021 researchers documented TCP middlebox reflection, where censorship and filtering middleboxes were coaxed into flooding victims with block-page responses, a reflection vector that needs no open UDP service at all. The common thread is any system on the internet that will answer a forged request.

Why it matters under attack

Nothing in the arriving packets looks like an attack to the victim. They are ordinary protocol responses from real, well-run servers, so there is no malicious sender to block by reputation, only a crowd of innocent reflectors standing between the target and whoever aimed them. A stateful firewall meets a sharper version of the same problem. It expects a reply to match an outbound request it once saw leave, and reflected packets are replies to requests it never sent, so the reflexive habit of trusting responses works against it.

Reflection attack: forge the source, let strangers do the flooding Attacker spoofs victim IP Open reflectors DNS, NTP, SSDP, any UDP responder Victim sees only reflectors spoofed request reply bounced at victim The attacker is never in the path the victim can see BlackNeuron™
Animated reflection attack: an attacker spoofs the victim address on requests fanned out to many open responders, each of which bounces its reply onto the victim while the attacker stays off the visible path

The linchpin is the forged source address, and that is fixable in exactly one place: the network where the spoofed packet is first injected. If providers enforced source-address validation (BCP 38) at their edges, a packet claiming the victim's address could never leave, and reflection would collapse for want of a way to lie about who sent the request. That validation lives on networks the target has no authority over, and adoption has stayed partial for two decades, so the vector persists not because it is clever but because the fix depends on everyone else.

The oldest member of the family predates the UDP reflectors entirely. The Smurf attack of the late 1990s spoofed the victim's address onto ICMP echo requests sent to a network's directed broadcast address, so every host on the subnet answered the victim at once. Directed broadcast was eventually disabled by default, but the pattern it set, forge the source and let someone else send, is the same pattern in every reflector since.

What a DDoS test measures

Since the cure lives upstream, a test of the target measures how much reflected load the edge soaks up rather than whether it can be blocked. It shapes traffic to look like a flood of unsolicited replies and records the point where absorption fails: how much the scrubbing tier and edge capacity take before real traffic starts losing, and how many seconds of reflected packets reach the origin before mitigation engages.

There are boundary conditions unique to reflected traffic that the test verifies too. Is response traffic on ports the service does not actually originate being dropped or rate-limited at the edge? Do the stateful devices in the path cope with a flood of unsolicited replies rather than choking on state they cannot match? The family, and how each reflected protocol behaves under test, is laid out in Understanding DDoS Attack Vectors.