All DDoS Definitions
DDoS Testing Definition

UDP Reflection / Amplification

A UDP reflection/amplification attack abuses public UDP services to multiply an attacker's bandwidth. The attacker sends small requests to misconfigured servers (DNS, NTP, memcached, CLDAP, SSDP) while spoofing the victim's IP as the source. The servers reply to the victim with responses many times larger than the request, so a modest attacker can generate a very large flood.

UDP Reflection and Amplification: spoof the source, multiply the volume Attacker small UDP request src = victim small spoofed request Open UDP services DNS, NTP, SSDP, memcached, CLDAP reply to the source responses many times larger Victim link saturates Amplification factor = response / request DNS ~54x NTP ~556x SSDP ~30x CLDAP ~56x memcached ~51,000x these size scrubbing capacity Two properties in one vector Reflection: the reply lands on the spoofed victim Amplification: the response is larger than the request A test characterizes upstream absorption: the reflected volume the edge takes before clean traffic degrades, and the latency scrubbing adds. BlackNeuron™
Diagram of UDP reflection and amplification: a small spoofed request to an open UDP service returns a much larger reply to the victim, combining reflection with per-protocol amplification factors.

Why it matters in DDoS testing

Reflection/amplification is the canonical Layer 3 volumetric vector, and it is what scrubbing capacity is sized against. A test characterizes upstream absorption (the volume the edge can take before clean traffic degrades) and the latency artifact scrubbing introduces. The structural defense against reflection is source-address validation (BCP 38) at the carrier level; its uneven global deployment is the structural reason these attacks persist, which is why testing focuses on absorption rather than prevention.

The amplification mechanics of each vector are detailed in Understanding DDoS Attack Vectors.