Reflection and Amplification Attacks: How They Work

05 August 2026 · 1 min read · Peer1IX Team

Many of the largest DDoS attacks use reflection and amplification. A clear explanation — and what every network can do to stop contributing.

The basic trick

UDP does not verify the sender. An attacker sends small requests to many open servers with the source address forged as the victim’s IP.

The servers reply — to the victim. The victim is flooded with responses it never asked for.

Some protocols return responses much larger than the request. A small query can produce a large reply, multiplying the attacker’s bandwidth.

Open DNS resolvers, NTP servers with legacy commands enabled, memcached, SSDP, CLDAP and others.

Implement BCP 38/BCP 84 — filter packets with source addresses that should not come from a given interface. This stops spoofing at its origin.
Close open services — do not run open resolvers or misconfigured UDP services.
Monitor for unusual outbound UDP volumes.

Use edge filtering, flowspec and scrubbing to remove amplified traffic before it reaches you.

amplification attacksreflectionDNSNTP

ISPs face attacks aimed at their subscribers, their infrastructure and their customers' businesses. A layered approach to protection.

Virtual cross connects are private, but it is worth understanding exactly what that means — and when to add encryption.

Each cloud has its own security tools. A shared fabric lets you apply consistent controls to traffic moving between them.