DRDoS Explained: Distributed Reflected Denial of Service for Security+

A distributed reflected denial of service attack — DRDoS — combines two ideas that are individually simple and together very effective. It is worth separating them, because exams test the terms independently.

Distributed means many sources. Reflected means those sources are innocent third parties. Amplified means each one sends back more than it received.

Building Up From DoS

DoS. One machine attacks one target. Easy to block — drop traffic from that source.

DDoS. Many machines, usually a botnet, attack one target simultaneously. Harder to block, because there is no single source, and the attacker's own infrastructure is still ultimately involved.

DRDoS. The attacker does not send traffic to the victim at all. Instead they send requests to thousands of legitimate public servers with the source address forged to the victim's. Every server replies to the victim, because that is where the request appears to have come from.

Two things the attacker gains. First, anonymity — the victim sees traffic from thousands of genuine, well-behaved servers, and tracing back requires cooperation from every one of their operators. Second, when the reflectors return more data than they received, amplification, which multiplies the attacker's bandwidth.

Reflection and Amplification Are Not the Same Thing

This distinction is a favourite exam point.

• Reflection bounces traffic off a third party, hiding the true source. A reflected attack with no amplification is possible — it just is not very efficient.
• Amplification means the response is larger than the request. It is what turns a modest uplink into a flood.

Most real attacks use both, which is why the terms get conflated. A question asking which property hides the attacker wants reflection; one asking which property increases volume wants amplification.

Why UDP Is Always Involved

Reflection needs source address spoofing, and spoofing needs a protocol with no handshake. TCP's three-way handshake means a spoofed SYN produces a SYN-ACK to the forged address and the connection never completes — you cannot reflect a meaningful payload. UDP has no handshake, so the server simply answers whoever it thinks asked.

That is why every significant reflector is a UDP service.

The Common Reflectors

Protocol	Port	Rough amplification
Memcached	11211	Extreme — tens of thousands to one
NTP (monlist)	123	Several hundred to one
CLDAP	389	Around 50–70 to one
DNS	53	Roughly 28–54 to one
SSDP	1900	Around 30 to one
SNMP	161	Around 6–10 to one
Chargen	19	Around 350 to one

The pattern is constant: a UDP service that answers unauthenticated requests with a larger response. Understand that sentence and you can identify a new reflector without having memorized it.

Defending

If you are the victim, the crucial point is that mitigation must happen upstream. Once your internet link is saturated, your own firewall is behind the congestion and can do nothing — the packets are already dropped before reaching it. You need a DDoS scrubbing service, provider-level filtering, anycast distribution, or a CDN. Have the ISP contact and the escalation path agreed in advance.

If you might be a reflector, which every organization running public UDP services might be: do not expose services that need not be public, disable the amplifying commands (NTP monlist, SNMP public community strings, open DNS recursion), rate-limit responses, and patch.

The structural fix is BCP 38 / RFC 2827 ingress filtering — network operators dropping outbound packets whose source address does not belong to their network. This makes spoofing impossible at the origin and would end the entire attack class. It has been recommended since 2000 and remains incompletely deployed, which is why these attacks persist.

Security+ (SY0-701) Exam Tips

• Distributed = many sources; reflected = bounced off third parties; amplified = larger response than request.
• UDP and source spoofing are the enablers. Know why TCP does not work for this.
• Recognize the reflectors: DNS, NTP, SSDP, SNMP, CLDAP, memcached, chargen.
• Victim mitigation is upstream. An answer choice about configuring the local firewall is wrong for a volumetric attack.
• BCP 38 ingress filtering is the structural defense against spoofing.
• Know the DoS categories: volumetric, protocol (SYN flood), and application layer (HTTP flood, Slowloris) — they need different defenses.
• Availability is the CIA element under attack.

Network+ and CySA+ Angles

Network+ (N10-009) covers DoS and DDoS as network attacks and the traffic patterns that identify them, plus the role of rate limiting and filtering.

CySA+ (CS0-004) expects detection and response: reading flow data during a volumetric event, recognizing inbound responses to requests your hosts never sent, identifying your own servers acting as reflectors in someone else's attack, and coordinating with providers during an incident.

Key Takeaways

• DRDoS spoofs the victim's address so third-party servers flood them, hiding the attacker entirely.
• Reflection provides anonymity; amplification provides volume. They are separate properties.
• Only UDP services work as reflectors, because spoofing requires no handshake.
• Memcached, NTP, DNS, CLDAP and SSDP are the classic reflectors.
• A saturated link can only be fixed upstream — scrubbing services and provider filtering.
• Do not be a reflector: restrict public UDP services and disable amplifying commands.
• BCP 38 would end the attack class if it were universally deployed.