{"id":177,"date":"2026-07-18T09:00:00","date_gmt":"2026-07-18T09:00:00","guid":{"rendered":"https:\/\/backendside.com\/blog\/?p=177"},"modified":"2026-07-21T16:19:29","modified_gmt":"2026-07-21T16:19:29","slug":"detect-amplification-attacks-sflow","status":"publish","type":"post","link":"https:\/\/backendside.com\/blog\/2026\/07\/18\/detect-amplification-attacks-sflow\/","title":{"rendered":"Detecting DNS, NTP, and Memcached Amplification Attacks from sFlow"},"content":{"rendered":"

Amplification attacks are the reason a handful of spoofed packets can knock a target offline with hundreds of gigabits of traffic. They’re cheap to launch, brutally effective, and they abuse services you probably run yourself. The good news: they leave an unmistakable fingerprint in your flow data. Here’s how DNS, NTP, memcached, and other amplification attacks work—and how to spot them the moment they start using sFlow.<\/p>\n

\n \"Diagram
A small spoofed request, a huge response—aimed at the victim.<\/figcaption><\/figure>\n

How amplification actually works<\/h2>\n

Every amplification attack follows the same recipe. The attacker sends a small request to a server that speaks a UDP protocol, but spoofs the source address<\/strong> so the reply goes to the victim instead. Because the response is many times larger than the request, the attacker turns a trickle into a torrent. The multiplier—the amplification factor<\/em>—varies wildly by protocol:<\/p>\n\n\n\n\n\n\n\n\n\n\n
Protocol<\/th>\nPort<\/th>\nTypical amplification<\/th>\n<\/tr>\n<\/thead>\n
Memcached<\/td>\n11211<\/td>\nup to ~50,000×<\/td>\n<\/tr>\n
NTP (monlist)<\/td>\n123<\/td>\nup to ~550×<\/td>\n<\/tr>\n
DNS<\/td>\n53<\/td>\n~28–54×<\/td>\n<\/tr>\n
SSDP<\/td>\n1900<\/td>\n~30×<\/td>\n<\/tr>\n
LDAP \/ CLDAP<\/td>\n389<\/td>\n~50×<\/td>\n<\/tr>\n
SNMP<\/td>\n161<\/td>\n~6×<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Memcached is the nightmare case: a few hundred bytes can become megabytes.<\/p>\n

The flow-data fingerprint<\/h2>\n

Amplification traffic looks nothing like legitimate use, and that’s exactly what makes it detectable in sFlow:<\/p>\n