The GetBulk request was added to SNMP with version 2 in the early 1990s, so that a management station could walk a large table in one round trip instead of hundreds. It still matters because that efficiency, pointed at a forged source address, is SNMP amplification: a Layer 4 reflection vector a thorough DDoS test exercises because the reflectors are network gear, often the operator's own. The generic part, a spoofed UDP request answered by a third party to the victim, is the amplification attack recipe and is not repeated here.
What makes SNMP amplification specific
SNMP, the Simple Network Management Protocol, is how monitoring systems read counters and configuration from routers, switches, printers, UPS units and servers. Agents listen on UDP port 161. In versions 1 and 2c the only credential is the community string, sent in clear text, and a large share of devices ship with the read-only community set to public.
What sets this vector apart is that the attacker, not the server, decides how big the answer is. A GetBulkRequest carries a max-repetitions field that says how many rows of a table to return in one response. An attacker names a large table, the interface list or the routing table, and asks for as many rows as the agent will pack in. The reply grows until it hits the agent's maximum message size. US-CERT's advisory TA14-017A puts SNMPv2 at about 6.3 times, a modest amplification factor for the family, but a device with a large table and a generous message limit can do considerably better, and the attacker can tune the request per device.
The reflector population is also unusual. SNMP is not a consumer service like SSDP or a forgotten developer tool like memcached. It is infrastructure, and exposed agents are overwhelmingly on routers, CPE and managed switches whose management plane was never separated from the public interface. Akamai's Prolexic team issued a threat advisory on SNMP reflection in 2014 after tracking it in live campaigns, pointing to default community strings as the enabler.
Why it matters under attack
Inbound, SNMP reflection behaves like the rest of the family. The replies are valid SNMP responses from real devices, reputation lists have little to grip, and the volume has to be absorbed or filtered upstream before the circuit fills. Legitimate SNMP traffic almost never crosses the public internet toward a web property, so a provider-side rule on UDP source port 161 removes the vector cheaply.
Outbound is where SNMP differs, and where the risk is closest to home. A network that answers GetBulk with public from the internet is doing three harmful things at once: it is a reflector for other people's floods, it is spending its own uplink on those replies, and it is publishing its interface list, routing table and system description to anyone who asks. SNMPv3 with authentication, or simply an ACL restricting port 161 to the management network, closes all three. Upstream, BCP 38 would stop the forged requests at their origin, but that sits with other operators.
What a DDoS test measures
The first check is outward-facing and binary: does any device you run answer SNMP on its public interface, with public, private or any guessable community. That includes the CPE and out-of-band gear nobody lists as an asset, which is where exposed agents usually turn up.
The second is the inbound absorption question: whether the source-port 161 rule is in place at the provider edge, how quickly mitigation engages, and whether monitoring traffic you do rely on, such as a hosted monitoring service polling across the internet, is caught by the same rule. Understanding DDoS Attack Vectors puts SNMP next to the reflectors it is usually confused with.