Skip to content

Reflection & amplification

1. Context & stakes

Measure the amplification factor (DNS/NTP/memcached) in-lab.

Reflection abuses UDP services - DNS, NTP, memcached, SSDP - that answer a small spoofed request with a large response; the attacker forges the victim as source, and the service floods the victim. Amplification factors reach roughly 50x for DNS and thousands for memcached, letting a modest attacker generate terabit floods. Source-address validation and closing open reflectors are the fixes.

2. Theory

Reflection abuses a UDP service that answers a small spoofed request with a large reply aimed at the victim (DNS ANY, NTP monlist, memcached). The amplification factor (reply/request size) multiplies the attacker's bandwidth. This module measures that factor in-lab; the fix is source anti-spoofing (BCP38) and disabling the abusable commands.

3. Attack (PoC)

netlab-amplif attack --i-own-this-network --iface veth-host
  1. Spoofed request -> amplified reply toward the victim (lab-measured)

4. Detection

netlab-amplif detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Source anti-spoofing (BCP38)
  • Disable recursion / monlist

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading