A reflection attack is a denial-of-service technique in which an attacker spoofs the target’s IP address in requests sent to third-party servers. Those servers, acting as reflectors, send their responses to the target instead of the attacker. section 11.2.1 section 11.6
Recognize the attack by these characteristics:
- Uses a falsified source IP address belonging to the target, making the target appear to have sent the requests. section 11.2.1
- Relies on third-party servers, called reflectors, to generate responses and overwhelm the target. section 11.2.1
- Becomes an amplification attack when a small request produces an asymmetrically large response; NTP and DNS are common protocols. section 11.2.1 section 11.6
Figure 11.4 A reflection/amplification attack. The attacker sends spoofed requests to third-party servers (reflectors), triggering asymmetrically large responses that are sent to the target, overwhelming it and resulting in a denial of service.
Trace the attacker’s spoofed requests, the reflectors’ disproportionately large responses, and the resulting denial of service. section 11.2.1
