Why UDP floods dominate: UDP needs no handshake, so spoofing a victim's source address is trivial. Attackers fire small queries at open services — DNS resolvers, NTP servers, CLDAP, memcached — which reply to the forged address with responses many times larger. The victim receives a flood it never requested.
1. The common amplification vectors
Open-protocol abuse is what turns a botnet's modest uplinks into hundreds of gigabits at the victim. The well-documented multipliers:
- DNS amplification: a ~60-byte ANY query can return a multi-kilobyte response — a classic ~28–54x amplifier.
- NTP monlist: the deprecated
monlistcommand returns a client list hundreds of times larger than the request — historically up to ~556x. - CLDAP: connectionless LDAP reflection, commonly ~46–70x.
- Memcached: the most extreme documented vector — a single request can trigger responses ~10,000–51,000x larger.
"Carpet-bombing" is the same idea applied sideways: instead of saturating one IP, the attacker spreads moderate traffic across an entire prefix, staying under per-IP alert thresholds while still filling the transit links.
2. How mitigation actually works — the layers
- Edge ACLs: dropping the junk that should never arrive — invalid TCP flag combinations, traffic from source ports known for reflection (123/NTP, 389/CLDAP, 1900/SSDP) toward services that don't use them. Cheap, instant, but only good for obvious junk.
- Rate limiting & protocol validation: sane per-source and per-protocol caps, SYN authentication (SYN cookies), dropping malformed game-protocol packets before they reach the VM.
- Upstream scrubbing: when the attack exceeds the link, the datacenter's upstream providers and dedicated mitigation systems filter it before it saturates the pipe. This is where capacity actually lives — no 10 Gbps customer link survives a 50 Gbps flood on its own.
- BGP blackhole (null-route): the last resort — the entire target IP is withdrawn from routing. Stops the flood completely, and takes the legitimate service down with it. It protects the network by sacrificing the customer.
3. Why null-routing is the real question to ask about
Every host "mitigates DDoS" in the trivial sense — a null-route technically ends the flood. The question that separates protection from self-immolation is: what happens before the null-route? Providers that scrub keep your service up through the attack; providers that blackhole the moment traffic exceeds a threshold are doing the attacker's job for them.
Honest answer for our platform: our Delhi NCR, Mumbai and Singapore locations sit behind upstream volumetric DDoS filtering (the ddos flag on those regions in our catalog is real), which absorbs the L3/L4 floods that dwarf any single node. Application-layer attacks — malicious logins, game-protocol abuse, HTTP floods — are still the customer's layer to defend; we document per-VM firewalling because upstream filters can't tell a bad Minecraft handshake from a good one.
4. What you should demand from any host
- A stated mitigation capacity and method — "protected" without a number is marketing.
- A clear answer to "when do you null-route, and for how long?"
- Whether filtering is in-country/on-net — detouring traffic through distant scrubbing centers adds latency to clean traffic permanently.
- Free, always-on protection — per-incident billing turns your worst day into their upsell.