SESK: Stuff Everyone Should Know · sesk.info/secplus-reflection-amplification
In a reflection DDoS attack, what do attackers send to third-party servers?
Spoofed packets, so the reflectors send their replies to the victim.
- Packets with the victim's spoofed source address ✔
- Packets with the reflector's real password
- Encrypted copies of the victim's data
Why: Reflectors answer requests, so replies flood the victim instead of the attacker. With amplification, a small request triggers a much larger reply.
Huh, didn't know that: MITRE ATT&CK calls the third-party servers used in this attack reflectors.
What do you get when you cross a dog and a computer? A machine that has a bark worse than its byte.
Like this card?
References
Answer: Packets with the victim's spoofed source address. Reflectors answer requests, so replies flood the victim instead of the attacker. With amplification, a small request triggers a much larger reply.
- MITRE ATT&CK T1498.002, Reflection Amplification attack.mitre.org/techniques/T1498/002
An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim.
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyA flood of fake traffic knocks a website offline. Which CIA property does this attack target?Security & PrivacyCapturing valid login data and sending it again later to impersonate a user is called what?Security & PrivacyAn attacker secretly positions themselves between two devices to sniff or change their traffic. What is this attack called?
That's stuff everyone should know.