9
  • Reflection Attack: Reflection attacks are attacks that use the same protocol in both directions. The attacker spoofs the victim’s IP address and sends a request for information via UDP to servers known to respond to that type of request. The server answers the request and sends the response to the victim’s IP address.

  • Amplification Attack: Amplification attacks generate a high volume of packets to flood the target website without alerting the intermediary, by returning a large reply to a small request.

I got that Reflection attack Generate request to some servers and reflect those reply to the victims IP. But what I don't understand is, from the definition of Amplification attack it seems almost like Reflection attack.

So my question is, what's the core difference between Amplification and Reflection attack?

For your information, it is not similar as dns reflection attack vs DNS amplification attack because I am asking in terms of DOS not specifically DNS which makes it much broader than that question.

  • From the answer to the question you linked: "DNS amplification, like other amplification attacks, is a type of reflection attack." – Bergi Mar 7 '18 at 23:04
  • "it is not slimier" All attacks are slimy! – NH. Mar 8 '18 at 19:46
16

TL;DR: amplification attack is a reflection attack where the reply is larger than the the request.


Reflection attack is if the reply is send back to the claimed origin of the request. With a spoofed source IP the attacker can make the reflecting server send the reply to the selected victim.

Amplification is if the reply is larger then the request. An amplification attack is a kind of reflection attack, where the attacker sends a small request with a spoofed source IP address and then this results in a big (i.e. amplified) reply to the claimed source of the request, i.e. the victim. By using this amplification an attacker can use few resources to attack a large target - the higher the amplification factor is the less resources are needed by the attacker.

A currently widely discussed amplification attack is using an insecure setup of memcached and due to the protocol spoken by memcached in can result in an amplification factor of about 50.000. See Memcrashed - Major amplification attacks from UDP port 11211 for more details. Other protocols used in the past for amplification attacks were for example NTP or DNS.

  • What, they didn't register memcrashed.org? I don't see a logo either. – immibis Mar 7 '18 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.