Unlike NTP or memcached amplification, an SSDP amplification attack does not rely on a server someone chose to put on the internet; its reflectors are home routers, cameras and printers answering a protocol that was only ever meant for the local network. That makes it a Layer 4 reflection vector with the largest and least manageable reflector pool in its family, and one a thorough DDoS test has to model as volume from everywhere rather than from a list. The shared recipe, a forged source address on a small UDP request that a third party answers with something bigger, is covered under amplification attack.
What makes SSDP amplification specific
SSDP, the Simple Service Discovery Protocol, is the discovery half of UPnP. A device joining a home network sends an M-SEARCH to the multicast group 239.255.255.250 on UDP port 1900, and everything on the LAN that offers a service answers directly with its details. It is a neighbourhood protocol by design, with no authentication and no reason to cross a router.
The abuse depends on a firmware mistake rather than a protocol feature. A large number of consumer routers answer unicast M-SEARCH requests arriving on their WAN interface, so anyone on the internet can ask them what they offer. Asking with ST: ssdp:all, "tell me about every service", makes the device send one reply per service it runs, each carrying a location URL, server string and service type. US-CERT's advisory TA14-017A rates the vector at about 30.8 times, and because the answer is several separate packets rather than one large one, the flood arrives as a stream of ordinary-sized datagrams, not as fragments.
The amplification factor is middling for the family. What makes SSDP dangerous is the count. Internet-wide scans have found reflectors in the millions, sitting on residential lines in every country, and because those lines use dynamic addressing the set changes daily. Cloudflare wrote up SSDP floods passing 100 Gbps in 2017, the year it nicknamed the protocol "Stupidly Simple DDoS Protocol".
Why it matters under attack
A reflector pool that large defeats the defences that work for smaller families. There is no short list of abused servers to block, no operator to call, and no advisory that will patch millions of routers whose owners do not know the setting exists. Reputation lists churn as residential addresses rotate, so yesterday's blocklist misses today's reflectors and catches today's legitimate customers.
The saving grace is the source port. Most replies leave the device from UDP port 1900, and no public service a normal website depends on sends traffic from that port. An upstream rule on source port 1900 removes most of the flood at almost no cost, with a small residue from devices that reply from an ephemeral port. As with every reflected vector, the rule has to sit at the provider or scrubbing tier: a filter on your own firewall protects the host after the circuit has already filled. The real cure, carriers applying BCP 38 so the forged M-SEARCH never leaves, sits on networks you do not run.
What a DDoS test measures
A test here is a test of absorption and of one rule. It drives a load shaped like reflected SSDP, many sources, modest packets, source port 1900, and measures whether the upstream filter engages before the link saturates, how long mitigation takes to cut over, and what residue gets through from off-port replies.
It also checks how the edge copes with the number of distinct sources, since some mitigation profiles key on per-source rates and a flood spread thinly across a very large population can stay under every per-source threshold. Where the traffic mix includes real UPnP or IoT customers, the test confirms they are not collateral.
What that means for choosing a managed edge that can absorb a residential-sized reflector pool is worked through in AWS Shield vs Cloudflare DDoS Protection.