All DDoS Definitions
DDoS Testing Definition

SSDP Amplification

An SSDP amplification attack is a Layer 4 reflection and amplification vector, one of the volumetric classes a thorough DDoS test is built to exercise. SSDP (Simple Service Discovery Protocol) runs over UDP 1900 on UPnP-enabled devices: routers, printers, cameras, and media servers. The attacker spoofs the victim's IP in a small discovery request, and each exposed device replies with a much larger response listing its services. With millions of consumer devices reachable, the reflected traffic builds a flood many times the size of the original request.

SSDP Amplification: a tiny UPnP discovery, a much larger reply Attacker spoofs src = victim sends M-SEARCH M-SEARCH to UDP 1900 ~100 bytes, src = victim UPnP devices routers, cameras, printers, media servers reply with a service list larger response around 30x bigger, to the victim Victim link fills with device listings ~30x per device, multiplied across millions of exposed consumer devices A test measures whether edge or provider scrubbing absorbs the reflected volume before it reaches the origin link. BlackNeuron™
Diagram of SSDP amplification: a small M-SEARCH to UDP port 1900 makes exposed UPnP devices reply with a much larger service listing aimed at the spoofed victim.

Why it matters in DDoS testing

SSDP attacks deliver high bandwidth from a vast pool of reflectors, so blocking individual sources is futile and the only viable filtering is upstream of the origin link. Testing measures whether edge or provider scrubbing absorbs the volume before it reaches the pipe, and how mitigation capacity compares across managed services, the kind of question explored in AWS Shield Advanced versus Cloudflare.