Reflection-amplification is a DDoS technique that abuses third-party servers to send much larger volumes of traffic to a victim. An attacker sends small requests with a spoofed source address set to the target, and exposed services such as DNS, NTP, or other UDP-based responders reply to that forged address. Because the replies are larger than the original requests, the attacker multiplies traffic without needing equivalent bandwidth.
This matters because it lets an attacker hide behind reflected systems and generate floods that are harder to trace and more expensive to absorb. Defenders often see many sources, high packet rates, and asymmetric traffic patterns rather than a single obvious sender. Mitigations include source address validation, disabling open reflectors, rate limiting, filtering common amplification protocols, and using upstream DDoS protection that can detect and absorb the burst. In real attacks, reflection-amplification is often paired with spoofing to intensify impact; in defense, it is a key pattern to model during controlled DDoS testing and to block at the network edge.