I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP amplification attacks in general. At one point, CloudFlare suggests that - if you must use UDP - to make the response packet size smaller than the request packet size, specifically they say:


My question: since these attacks are reflected (source IP address is spoofed to be the target IP), why does it matter what the UDP request size is? Suppose I send a UDP packet with maximum_size to some UDP service that responds with maximum_size-1. It's smaller than request size, but still a problem -- mainly because of the reflection. Even a small response size will be a problem if the # of hosts I'm using for reflection is great enough.

Is this right or am I missing something?

1 Answer 1


If the request packet are larger than the response packets, you (as the attacker) would have been better off just sending the packets directly to the target.

It's also worth thinking about where you can find those amounts of bandwidth. If you're doing a direct (as in not reflected) attack you will need as much bandwidth in your end as you want to hit the target. So if you want to hit a target with X Gb/s you need to control devices with a total bandwidth of X Gb/s - and be able to fully utilise those links. But when reflecting the traffic, you only need X/, that might be a lot easier to acquire, and you only need to be able to make a device send a e.g. NTP packet with a spoofed sender, probably a lot easier to acquire.

  • Hmmm, isn't the idea with the memcached UDP amplification that the memcached server (not the attacker) send the packets? If the attacker sent the packets directly, even with spoofed IP, wouldn't that be easier to trace/block (e.g., identifying routes/intermediaries)? I thought part of the reasoning for using an external agent in an amplification attack was to mitigate that issue. Similar to Stacheldraht. Commented Sep 10, 2019 at 22:40
  • It's correct that reflection might make the packets enter the target's network over different links, which they would probably not if they were send directly from one source. But it's even in the name that DDOS-attacks (this question is tagged ddos) do not come from one source. Commented Sep 11, 2019 at 6:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .