I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP amplification attacks in general. At one point, CloudFlare suggests that - if you must use UDP - to make the response packet size smaller than the request packet size, specifically they say:
My question: since these attacks are reflected (source IP address is spoofed to be the target IP), why does it matter what the UDP request size is? Suppose I send a UDP packet with maximum_size to some UDP service that responds with maximum_size-1. It's smaller than request size, but still a problem -- mainly because of the reflection. Even a small response size will be a problem if the # of hosts I'm using for reflection is great enough.
Is this right or am I missing something?