UDP amplification: length(response_packet) < length(request_packet)

Question

I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP amplification attacks in general. At one point, CloudFlare suggests that - if you must use UDP - to make the response packet size smaller than the request packet size, specifically they say:

My question: since these attacks are reflected (source IP address is spoofed to be the target IP), why does it matter what the UDP request size is? Suppose I send a UDP packet with maximum_size to some UDP service that responds with maximum_size-1. It's smaller than request size, but still a problem -- mainly because of the reflection. Even a small response size will be a problem if the # of hosts I'm using for reflection is great enough.

Is this right or am I missing something?

Answer 1

If the request packet are larger than the response packets, you (as the attacker) would have been better off just sending the packets directly to the target.

It's also worth thinking about where you can find those amounts of bandwidth. If you're doing a direct (as in not reflected) attack you will need as much bandwidth in your end as you want to hit the target. So if you want to hit a target with X Gb/s you need to control devices with a total bandwidth of X Gb/s - and be able to fully utilise those links. But when reflecting the traffic, you only need X/, that might be a lot easier to acquire, and you only need to be able to make a device send a e.g. NTP packet with a spoofed sender, probably a lot easier to acquire.