An amplification attack is a reflection attack in which an attacker sends a small spoofed request, using the target’s IP address, to third-party servers called reflectors. The reflectors return disproportionately large responses to the target, overwhelming it and causing a denial of service. section 11.2.1 section 11.6
Recognize the attack by its traffic pattern and classifications:
- The attacker spoofs the target’s IP address in requests sent to reflectors. section 11.2.1
- Reflectors send responses to the spoofed target rather than to the attacker. section 11.2.1
- A small request producing an asymmetrically large response provides the amplification effect. section 11.6
- The attack is simultaneously a reflection attack, a spoofing attack, and a denial-of-service attack. section 11.2.1
- NTP and DNS are common protocols because their small requests can generate large responses. section 11.2.1
Figure 11.4 A reflection/amplification attack. The attacker sends spoofed requests to third-party servers (reflectors), triggering asymmetrically large responses that are sent to the target, overwhelming it and resulting in a denial of service.
Trace the attacker’s spoofed requests, the reflectors’ asymmetrically large responses, and the resulting denial of service. section 11.2.1
