What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?

Short answer

In a Reflection & Amplification attack, the attacker writes the victim's IP address as the source address and sends small requests to third systems open to the internet (such as DNS, NTP, memcached); the much larger responses of these systems are directed at the victim (RFC 4732). With little traffic the attacker loads a large volume onto the victim, and the traffic looks as if it comes from legitimate servers. In TR7, the Reflected UDP rule located in the Reflection & Amplification box in the ICMP & Reflection band of the L4 DDoS Management screen limits per source the UDP packets that come from the eight service ports known to be used in amplification (chargen 19, DNS 53, portmap 111, NTP 123, SNMP 161, LDAP 389, SSDP 1900, memcached 11211) and that are not responses to a query made by the device itself (default 100/s, default mode Monitor). In addition to traffic directed at the device, the rule is applied to traffic passing through the device; reflection traffic directed at the servers behind a route table is also limited.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → ICMP & Reflection	Reflection & Amplification box; the pencil icon on the rule row → Status and Limit per Second	Limiting unrequested amplification responses per source
L4 DDoS Management → UDP → UDP flood	DNS Flood	Limiting per source the requests coming to DNS
Left Monitor Panel → Route Tables & L4 DDoS → route table → Dashboard	Floods tab	A graph of the reflection response rate per source together with the limit

• Source address spoofing: What is spoofing; what do the Spoofing, LAND / Self-Spoof and Martians settings in TR7 catch?

Common Misconceptions

• "The traffic is harmless because it comes from legitimate servers." The servers that respond are only reflectors; the attacker sent the requests by writing the victim's address as the source address.
• "The rule limits all DNS and NTP responses." Reflected UDP looks only at packets counted as new; since a response that comes to a query made by the device itself is part of an open exchange, it is not caught by the rule, and name resolution and time synchronization are not affected.
• "The rule also covers the reflector side." The rule protects the victim side; requests coming to a DNS service reached through TR7 are limited per source separately by the DNS Flood rule.

How it is done in the documentation

• Reflection & Amplification · What Is Reflection & Amplification?
• Reflection & Amplification · The Services Watched
• ICMP & Reflection · Rule Modes

Related questions

• What is a UDP Flood; why does TR7 apply a separate flood limit to DNS requests?
• What is spoofing; what do the Spoofing, LAND / Self-Spoof and Martians settings in TR7 catch?
• What is a Smurf attack; what do the Smurf rules in TR7 limit?