All DDoS Definitions
DDoS Testing Definition

TCP Middlebox Reflection

TCP middlebox reflection was first documented in 2021, when researchers showed that the censorship and content-filtering boxes sitting in the middle of many national and corporate networks could be turned into TCP reflectors. It still matters because those middleboxes are permanent fixtures of the internet, and it is one of the reflection vectors a thorough DDoS test now has to account for. Like every member of the reflection attack family it forges the victim's address so a third party answers the victim instead of the attacker; what is specific to this vector is that the third party is a filtering middlebox and the transport is TCP.

TCP middlebox reflection: a banned request, a large block page Attacker spoofs src = victim crafted SYN carries a forbidden request small TCP packet no real handshake needed Censorship / filter middlebox sees a banned request, injects a full block page back to the source large block page many times the request size Victim receives TCP data it never requested TCP was long assumed unspoofable the middlebox answers before the handshake completes A test checks that stateful filters drop out-of-state SYN-ACK and data floods before reflected TCP saturates the link. BlackNeuron
TCP middlebox reflection: a small spoofed request makes a censorship middlebox send a large block page to the victim.

Why a middlebox reflects over TCP

The received wisdom was that TCP could not be reflected. A spoofed SYN draws only a SYN-ACK back at the victim, and without completing the handshake the attacker cannot make a server send real payload, so the amplification factor stays near one. Middleboxes break that assumption because they do not behave like a proper TCP endpoint.

A censorship or content-filter box is built to inject a response the moment it sees a banned request, without waiting for the handshake to finish or checking that the connection state is real. The attacker sends a crafted packet, often a SYN carrying a forbidden HTTP request line with a blocked hostname, and forges the victim's IP as the source. The middlebox sees the banned string, decides it must act, and injects a block page or redirect aimed at the victim. No open UDP service is involved, and none of the usual TCP state checks apply.

The size gap is the headline, and it can be extreme. The 2021 research found hundreds of thousands of reflecting addresses with amplification factors above 100, some exceeding the best UDP reflectors, and a class of middleboxes that were effectively infinite amplifiers: one packet could trigger an unbounded stream of block-page responses, because a routing loop or a retransmitting box kept firing at the victim indefinitely. Akamai reported the first of these attacks in the wild in 2022.

Why it matters under attack

The traffic arriving at the victim is TCP that never completed a handshake: a flood of unsolicited SYN-ACKs, PSH-ACKs, and data segments belonging to connections the victim never opened. That confounds a stateful filter, which expects an inbound reply to match an outbound request it once saw leave, exactly the reflexive trust that the wider reflection family exploits.

Two properties make it awkward beyond the usual reflection problem. Because it runs over TCP, it can be aimed at ports that a UDP-focused filter waves through, and it reaches services that expect TCP anyway. And because a single infinite-amplifier middlebox can sustain a flood on its own, an attacker needs far fewer reflectors than a UDP campaign would, so the source set is small and easily replaced.

TCP middlebox reflection: one spoofed request, a block-page flood Spoofed SYN one small packet one small packet Filtering middlebox no handshake, no state check factor 100x and up, some unbounded block page stream Victim Runs over TCP, so a UDP-focused filter can wave it through BlackNeuron
TCP middlebox reflection in motion: a single spoofed SYN carrying a banned request enters a filtering middlebox, which injects a far larger block-page stream aimed at the victim, the size asymmetry that defines the vector.

The structural fix lives, as with every reflector, on the networks where the spoofed packet is injected: source-address validation (BCP 38) would stop a packet claiming the victim's address from ever leaving. That control sits on networks the target does not run, and the middleboxes themselves belong to censors and enterprises with no incentive to change, so the vector persists for the same reason the rest of the family does.

What a DDoS test measures

The source of this traffic sits on networks the victim does not run, so the test question is not whether the flood can be blocked but how much of it the target absorbs and how its stateful devices cope with TCP that belongs to no connection they opened. It shapes traffic to look like reflected out-of-state TCP and records two things: whether the stateful devices in the path drop unsolicited SYN-ACK and data segments cleanly rather than choking on state they cannot reconcile, and how much reflected volume the edge and scrubbing tier swallow before goodput falls.

The deliverable is the absorption headroom and the point at which out-of-state TCP starts costing real connections. How this sits alongside the UDP reflectors it is usually grouped with is described in Understanding DDoS attack vectors.