Ravi Sir's Cyber Security Cards › Revision Cards
Amplification and Reflection – Closed Lab Only
Amplification and Reflection – Closed Lab Only In a reflection attack, the attacker spoofs the victim’s IP, so public servers send their replies to the victim. Amplification : a small request causes a big reply. In 2018, misused public Memcached servers created enormous reflected floods. Never scan
Read card text
What this card says
What it is
In a reflection attack, the attacker spoofs the victim’s IP, so public servers send their replies to the victim.
Amplification: a small request causes a big reply.
Example
In 2018, misused public Memcached servers created enormous reflected floods.
Why it matters for security
Never scan or use public DNS/NTP/Memcached servers for this, and never spoof. It is illegal.
Defence: block spoofed source IPs, don’t expose these services.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Spoofs victim IP; queries open amplifiers | Anti-spoof egress; shut open resolvers; block UDP 11211… |
| Hopes SME leaves lab Memcached on 0.0.0.0:11211 | Security group / firewalld: private only; ss -ulnp audit |
| Uses amp for "anonymous" volume | Scrubbing centre recognises amp signatures; source is… |
Learn more in the lesson: 40.4 Amplification and Reflection – Closed Lab Only