The Reflection Attack

A reflection attack is a type of Distributed Denial of Service (DDoS) attack where an attacker sends requests to legitimate servers using the victim's spoofed IP address. The servers unknowingly respond to these requests, directing their responses to the victim instead of the attacker. This creates a flood of unwanted traffic that can overwhelm the victim's network connection.

Reflection attacks are particularly effective because they use legitimate infrastructure to carry out the attack, making them difficult to detect and block. The attacker remains hidden while legitimate servers become unwitting participants in the assault.

How It Works

Reflection attacks operate through IP address spoofing and amplification. The attacker sends small requests to multiple servers, forging the source IP address to match the victim's address. When servers respond, they send their replies directly to the victim, creating massive traffic volumes that can overwhelm the target's bandwidth and resources.

The attack becomes more devastating when combined with amplification, where the server's response is significantly larger than the original request. For example, a 64-byte DNS query can generate a 3,000-byte response, amplifying the attack by nearly 50 times.

Types of Reflection Attacks

DNS Reflection Attacks

These attacks exploit Domain Name System servers by sending queries with the victim's spoofed IP address. DNS servers respond with large query results, flooding the victim with unwanted DNS traffic. Attackers often target ANY queries to maximize response size.

NTP Reflection Attacks

Network Time Protocol servers can be abused using the monlist command, which returns information about recently connected clients. This creates substantial amplification, as a small request can trigger responses containing hundreds of IP addresses.

SNMP Reflection Attacks

Simple Network Management Protocol servers respond to GetBulk requests with large amounts of network device information. Attackers exploit poorly configured SNMP devices to generate massive response traffic directed at victims.

Amplification Comparison

Protection Methods

Defending against reflection attacks requires implementing multiple layers of security controls:

• Rate limiting Configure servers to limit response rates and implement request throttling to prevent abuse.

• Ingress filtering Deploy network filters that block packets with spoofed source IP addresses at network boundaries.

• Server configuration Disable unnecessary services like NTP monlist and restrict SNMP access to authorized networks only.

• Traffic monitoring Implement real-time monitoring to detect unusual traffic patterns and automated response systems.

• DDoS mitigation services Use cloud-based protection services that can absorb and filter malicious traffic before it reaches your network.

Conclusion

Reflection attacks exploit legitimate servers to overwhelm victims with amplified traffic, making them difficult to detect and defend against. Organizations must implement comprehensive protection strategies including rate limiting, ingress filtering, and proper server configuration to mitigate these threats effectively.