← News
/PLAYBOOK · 2026-09-06

How do UDP amplification attacks work? How do you defend a server?

UDP amplification reflection, commonly abused protocols and amplification factors, how to tell you are being hit, iptables emergency drops, reflector self-audit, and DDoS-protected CDN. FAQ.

UDP amplification is the highest cost-efficiency attack in the DDoS family: 1 byte of request traffic can return tens to thousands of times that in response flood. This FAQ covers how UDP amplification works, commonly abused protocols, how to tell you are being hit, iptables emergency drop configs, and how to audit and fix a server that is being used as a reflector.

Q: What is a UDP amplification attack?

UDP amplification (UDP Amplification, also DrDoS) exploits UDP's lack of handshake and source-address verification. The attacker spoofs the victim's IP as the source of request packets, sends them to large numbers of third-party open services (public DNS, NTP, etc.). Those services receive a small request and send a much larger response to the victim. Attacker pays a tiny bandwidth cost; victim eats the amplified response flood; the third-party servers unwittingly act as accomplices.

Q: Which protocols get abused, and what are the amplification factors?

Memcached reflection is the highest amplification vector to date. The 1.35Tbps GitHub attack in 2018 used it.

Q: How do you tell a server is under UDP amplification?

Classic signature: inbound UDP spikes instantly, source IPs extremely scattered (all reflector responses):

`# Watch NIC bandwidth in real time
iftop -i eth0

# Tally UDP traffic source distribution
tcpdump -nn -i eth0 udp | awk '{print $3}' | cut -d. -f1-4 | sort | uniq -c | sort -rn | head`

If UDP far exceeds normal business levels, and source ports concentrate on 53 (DNS), 123 (NTP), 1900 (SSDP), 11211 (Memcached), it is reflection traffic.

Q: How do you emergency-block with iptables?

`# Drop response ports of common reflection protocols
iptables -A INPUT -p udp --sport 53 -j DROP
iptables -A INPUT -p udp --sport 123 -j DROP
iptables -A INPUT -p udp --sport 1900 -j DROP
iptables -A INPUT -p udp --sport 11211 -j DROP

# Rate-limit UDP so the CPU is not saturated
iptables -A INPUT -p udp -m limit --limit 100/s --limit-burst 200 -j ACCEPT
iptables -A INPUT -p udp -j DROP`

Note: UDP amplification volume usually exceeds the server's uplink. iptables can keep CPU from falling over; it cannot save a saturated pipe. Upstream scrubbing is required.

Q: How do you check whether your server is being used as a reflector?

If the server exposes UDP services, being abused means you are working for the attacker and burning IP reputation. Audit item by item:

Q: Can CDN and DDoS protection stop UDP amplification?

Yes. It is the most effective control. Ordinary CDN only proxies HTTP. UDP reflection hits the real origin IP, so you need a DDoS-protected IP or DDoS-protected CDN: hide the real IP behind DDoS-protected nodes, scrub reflection in the DDoS-protected PoP, only clean traffic returns to origin. Bandwidth attacks cannot be tanked on the server itself. Buy capacity before you need it.

Q: Hit by UDP amplification. Emergency steps?

Q: Any extra advice?

Three lines: disable UDP if you can — unused UDP ports off. Hide the real IP if you can — DDoS protection or CDN in front. Monitor with a bandwidth baseline. Discovery at T+10 min vs T+1 min is a completely different cost. UDP amplification is a bandwidth resource war. Playbooks and scrubbing capacity must be ready in advance.