thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Amplification Attack

A DDoS technique that sends small spoofed requests to services that return much larger responses to the victim.

Definition

Attackers spoof the victim's IP as the source of requests to open DNS resolvers, NTP (monlist), Memcached, CLDAP or SSDP servers, which reply with responses many times larger. This is also called a reflected attack. Mitigations include BCP 38 ingress filtering, closing open resolvers and rate limiting.

Example

A 60-byte DNS ANY query producing a 4,000-byte response directed at the victim.

Exam tip

Amplification requires IP spoofing and UDP; Memcached had amplification factors over 50,000x.

Related terms