Reflection Attack: How It Works and How to Prevent It
A reflection attack is a type of distributed denial-of-service (DDoS) attack in which criminals use legitimate third-party systems to flood a target with unwanted traffic. Instead of sending the traffic directly, the attacker causes servers, devices, or network services to send their responses to the victim. This approach can conceal the attacker’s origin and make the incident harder to manage. When the returned responses are much larger than the original requests, the attack becomes a reflection amplification attack—one of the more disruptive forms of DDoS.
What Is a Reflection Attack?
In a reflection attack, an attacker falsifies the source address on a network request so it appears to come from the intended victim. The request is sent to a reachable third-party service, known as a reflector. That service then sends its normal response to the victim’s address. The victim receives traffic from many legitimate-looking systems, even though it never requested it. This can consume bandwidth, overwhelm firewalls or load balancers, and make websites or applications unavailable.
The IETF identifies open recursive DNS servers as a common example: improperly exposed services can be abused to reflect traffic toward a third party.
How Does It Work?
At a high level, a reflection attack follows four stages:
- The attacker selects internet-facing services that will respond to requests.
- Requests are sent with the victim’s IP address forged as the sender.
- Each service sends its response to the victim rather than the attacker.
- The victim is flooded by responses from multiple systems.
The core weakness is IP source-address spoofing. When networks allow outbound traffic with invalid or forged source addresses, attackers can impersonate another system. Network ingress filtering—often referred to as BCP 38—is designed to stop such spoofed traffic at the network edge.
Reflection Attack vs. Amplification Attack
The two terms are often used together, but they describe different effects:
- A reflection attack redirects responses from third-party systems to the victim.
- An amplification attack makes the response traffic substantially larger than the original request.
- A reflection amplification attack uses both techniques at once.
For example, a small request can trigger a larger response from an exposed service. Repeating this through many reflectors multiplies the traffic delivered to the target. DNS is frequently associated with this risk because certain queries can generate larger replies; however, DNS itself is not inherently insecure. The practical problem is usually exposed, unrestricted, or poorly configured DNS infrastructure.
Common Types of Reflection Attacks
Reflection attacks can abuse any service that responds to requests without reliably validating the sender’s address. Commonly discussed examples include:
- DNS reflection attacks
- NTP reflection attacks
- SSDP reflection attacks
- CLDAP reflection attacks
- Memcached reflection attacks
DNS remains an important example because open recursive resolvers can be used as reflectors. The IETF’s guidance is clear: recursive DNS service should generally be limited to intended clients, and authoritative servers that do not need recursion should have it disabled.
Signs of a Reflection Attack
Security teams may suspect a reflection attack when they observe:
- A sudden surge of inbound UDP traffic
- Traffic arriving from many unrelated IP addresses
- Large volumes of response packets without matching internal requests
- Spikes in traffic from a particular protocol or service port
- Network congestion, packet loss, or degraded application performance
Because incoming packets come from legitimate third-party systems, simply blocking individual source addresses is often ineffective. Filtering must focus on traffic characteristics, protocol behavior, and verified service requirements.
How to Prevent Reflection Attacks
Preventing reflection attacks requires shared responsibility between service operators, network providers, and potential targets.
1. Stop IP address spoofing
Internet service providers and network operators should deploy ingress and egress filtering to prevent customers or internal systems from sending packets with forged source addresses. This reduces the attacker’s ability to redirect replies to a victim.
2. Secure exposed services
Do not expose services to the public internet unless there is a clear business need. For services that must remain available:
- Restrict access to known clients where possible.
- Disable unused protocols and features.
- Apply rate limits and response limits.
- Keep server software and firmware updated.
- Separate authoritative and recursive DNS functions.
NIST’s DNS deployment guidance also emphasizes securing DNS infrastructure and reducing the risk created by misuse or misconfiguration.
3. Use DDoS mitigation controls
Organizations that may be targeted should use layered DDoS defenses, such as upstream traffic scrubbing, content delivery networks, rate limiting, web application firewalls, and scalable network capacity. Establish monitoring baselines so sudden inbound traffic changes can be identified quickly.
4. Maintain an incident response plan
A reflection attack can escalate quickly. Maintain current contacts for your hosting provider, ISP, cloud provider, and DDoS mitigation partner. Your plan should document who can change firewall rules, reroute traffic, communicate with customers, and preserve evidence during an incident.
Final Thoughts
A reflection attack exploits trust in normal network responses. The most effective long-term defense is to prevent source-address spoofing and ensure publicly exposed services only answer the clients they are meant to serve. By combining secure service configuration, traffic monitoring, and a tested DDoS response plan, organizations can reduce both their risk of being targeted and their risk of being used as part of an attack.