A reflection attack is a volumetric attack vector, one of the spoofing-based classes a thorough DDoS test is built to exercise. The attacker never sends traffic to the victim directly. Instead it sends requests to large numbers of innocent third-party servers (reflectors) with the source IP forged to the victim's address, so every reply is bounced (reflected) at the target. This hides the attacker's real origin behind thousands of legitimate services, and when the reflectors also return larger responses than the request, it combines with amplification to multiply volume. Common reflectors are open DNS resolvers, NTP servers, and any UDP service that answers unauthenticated queries. Because the arriving packets are ordinary responses from real infrastructure, reflected traffic is harder to distinguish from legitimate replies than a direct flood.
Why it matters in DDoS testing
Reflection turns the internet's own infrastructure into the attack surface, which is why the traffic arriving at the victim looks like ordinary responses from real servers rather than obvious attack packets. A DDoS test measures whether the edge can absorb and filter high volumes of unsolicited reply traffic, and whether stateful defenses that expect a matching outbound request cope with replies to requests they never sent. Because the reflectors are legitimate and the source is spoofed, blocking by reputation is weak, so testing concentrates on volumetric absorption and the latency of scrubbing cutover. How each reflected protocol behaves under test is detailed in Understanding DDoS Attack Vectors.