What is UDP amplification and reflection?
UDP amplification turns a small spoofed query into a huge reply aimed at the victim. DNS, NTP, memcached, CLDAP and traffic reflected off CDNs.
Last updated:
In a reflection attack the attacker never fires at the victim directly. Instead they bounce traffic off other people's servers, sending queries with a forged source address set to the victim's, so the replies land there. When the reply is much larger than the query, we call it amplification: a few dozen bytes sent by the attacker turn into several kilobytes falling on the target. The amplification factor decides how little capacity is needed to produce an attack measured in hundreds of gigabits.
Protocols that lend themselves to it
- DNS: open resolvers answer queries from anyone, and the reply can be dozens of times larger than the question.
- NTP: the old monlist command would return a list of hundreds of recent clients in answer to one short packet.
- memcached: exposed to the internet without authentication, it produced the highest known amplification factors, in the thousands.
- CLDAP and SSDP: directory services and local device discovery, accidentally exposed to the public internet.
- QUIC and other UDP-based protocols: anywhere a server answers before verifying that the other party exists.
Traffic reflected off CDNs and other trusted networks
The most awkward variant reflects off infrastructure you neither want nor are able to block. The attacker spoofs the victim's address and sends requests to CDN edge nodes or to large public resolvers. The replies arrive at the victim from the address space of huge, widely used networks, with correct headers and a completely genuine sender address.
For an operator that is a trap. Blocklisting those ranges cuts subscribers off from content they actually use, so the cure hurts as much as the disease. Session state is what settles it: since nobody on the network sent a query matching that reply, the packet belongs to no connection and can be dropped without touching the CDN itself.
Why it still works
This whole family of attacks rests on one assumption: that you can send a packet with somebody else's source address and nobody along the way will check. Egress filtering along the lines of BCP 38 would solve it at the source, but deployment is voluntary and still incomplete, so spoofing remains possible. On top of that, the internet still holds millions of misconfigured services happy to answer anyone.
What to do on the victim's side
Replies nobody asked for are ideal material for stateful filtering, because by definition they match no outbound session. There is one condition: the filter has to sit above the bottleneck. If the amplified traffic saturates your uplink first, the equipment behind it has nothing left to defend. That is why mitigation for these attacks belongs at the carrier network edge rather than on the target server.
Frequently asked questions
Can I just block UDP?
Rarely, because you would also block DNS, QUIC, VPN, VoIP and game traffic, which is much of what subscribers are paying for. Blocking the specific source ports used in amplification is less invasive, but attackers change ports. The durable answer is stateful filtering, which tells a reply to your query apart from a reply nobody requested.
Could my network unknowingly take part in such an attack?
Yes, if you publicly expose an open DNS resolver, an NTP server or memcached. It is worth scanning your own address space for such services regularly and deploying BCP 38 style egress filtering so that packets with somebody else's source address cannot leave your network.