DoS amplification is a pattern in which a small stream of attacker-controlled requests causes a much larger amount of work, traffic, or resource use downstream. The attacker does not need huge bandwidth if the target, a proxy, or another intermediary expands each request into expensive processing or multiple backend actions.
This matters because defenders often focus on the size of inbound traffic, but amplification attacks exploit how systems behave after they receive it. Common examples include protocol translation, request rewriting, cache misses, recursive lookups, or responses that are far larger than the trigger. In a CDN or reverse-proxy path, a modest client request can force extra parsing and forwarding work at the origin. Good defenses include strict request validation, rate limiting, anomaly detection, and testing the full edge-to-origin path, not just the public endpoint.