TCP middlebox reflection was first documented in 2021, when researchers showed that the censorship and content-filtering boxes sitting in the middle of many national and corporate networks could be turned into TCP reflectors. It still matters because those middleboxes are permanent fixtures of the internet, and it is one of the reflection vectors a thorough DDoS test now has to account for. Like every member of the reflection attack family it forges the victim's address so a third party answers the victim instead of the attacker; what is specific to this vector is that the third party is a filtering middlebox and the transport is TCP.
Why a middlebox reflects over TCP
The received wisdom was that TCP could not be reflected. A spoofed SYN draws only a SYN-ACK back at the victim, and without completing the handshake the attacker cannot make a server send real payload, so the amplification factor stays near one. Middleboxes break that assumption because they do not behave like a proper TCP endpoint.
A censorship or content-filter box is built to inject a response the moment it sees a banned request, without waiting for the handshake to finish or checking that the connection state is real. The attacker sends a crafted packet, often a SYN carrying a forbidden HTTP request line with a blocked hostname, and forges the victim's IP as the source. The middlebox sees the banned string, decides it must act, and injects a block page or redirect aimed at the victim. No open UDP service is involved, and none of the usual TCP state checks apply.
The size gap is the headline, and it can be extreme. The 2021 research found hundreds of thousands of reflecting addresses with amplification factors above 100, some exceeding the best UDP reflectors, and a class of middleboxes that were effectively infinite amplifiers: one packet could trigger an unbounded stream of block-page responses, because a routing loop or a retransmitting box kept firing at the victim indefinitely. Akamai reported the first of these attacks in the wild in 2022.
Why it matters under attack
The traffic arriving at the victim is TCP that never completed a handshake: a flood of unsolicited SYN-ACKs, PSH-ACKs, and data segments belonging to connections the victim never opened. That confounds a stateful filter, which expects an inbound reply to match an outbound request it once saw leave, exactly the reflexive trust that the wider reflection family exploits.
Two properties make it awkward beyond the usual reflection problem. Because it runs over TCP, it can be aimed at ports that a UDP-focused filter waves through, and it reaches services that expect TCP anyway. And because a single infinite-amplifier middlebox can sustain a flood on its own, an attacker needs far fewer reflectors than a UDP campaign would, so the source set is small and easily replaced.
The structural fix lives, as with every reflector, on the networks where the spoofed packet is injected: source-address validation (BCP 38) would stop a packet claiming the victim's address from ever leaving. That control sits on networks the target does not run, and the middleboxes themselves belong to censors and enterprises with no incentive to change, so the vector persists for the same reason the rest of the family does.
What a DDoS test measures
The source of this traffic sits on networks the victim does not run, so the test question is not whether the flood can be blocked but how much of it the target absorbs and how its stateful devices cope with TCP that belongs to no connection they opened. It shapes traffic to look like reflected out-of-state TCP and records two things: whether the stateful devices in the path drop unsolicited SYN-ACK and data segments cleanly rather than choking on state they cannot reconcile, and how much reflected volume the edge and scrubbing tier swallow before goodput falls.
The deliverable is the absorption headroom and the point at which out-of-state TCP starts costing real connections. How this sits alongside the UDP reflectors it is usually grouped with is described in Understanding DDoS attack vectors.