Reflection & Amplification

What Is Reflection & Amplification?

Reflection & Amplification meets the half of the reflected amplification attack that reaches the device in the ICMP & Reflection band and does this with a single rule.

In a reflected attack the attacker sends no packet to the target at all. By taking on the address of the victim he sends requests to third systems open to the internet; those systems send the answers to the victim. Since the services used produce a much larger answer to a small request, the volume of the attack grows along the way; the name "amplification" comes from here.

The rule stands at the point where these answers reach the device: it limits per source the UDP responses that come from the eight services known to be used in amplification and that are unrequested.

1

Rule

There is a single rule in the box

8

Service Port Watched

The source ports known to be used in amplification

100/s

Default Ceiling

The number of responses per second per source

Monitor

Default Mode

In an untouched route table it is born in the monitoring mode

Yes

Quarantine

The rule can send the source to quarantine

Victim Side

Protection Direction

It limits the reflection coming to the device; it does not prevent being used as a reflector

The rule protects the device as the victim, not as the reflector

In a reflected attack there are two separate roles: the victim on whom the answers rain and the reflector that produces the answers. This rule meets only the first one; it limits the unrequested responses that come to the device.

The device itself being used as a reflector, that is, a service running on it attacking others by producing answers to requests with a fake address, is not in the scope of this rule. For this the access control of the service in question is used.

The Reflection & Amplification Box on L4 DDoS Management

The box is the third box in the body of the ICMP & Reflection band. In its header there are its name and the number of rules it carries, and in its body a single rule row.

ICMP & Reflection - The Reflection & Amplification Box

Row	Rule	What it catches
1	Reflected UDP	The UDP responses that come unrequested from the eight amplification services.

Reflected UDP

Determines how many unrequested responses will be accepted per second per source. Its definition in the information band is as follows: (Reflection / amplification) - Unsolicited amplification-service response limit.

Reflected UDP Edit Screen

INFO

Status

Selects the rule's operating mode. Four values are offered, and the selected value also determines the sentence on the row:

Value	The sentence in the row
Disabled	A limit of <limit> unsolicited amplification-service responses per second is configured, but the rule is off
Monitor	A source may send at most <limit> unsolicited amplification-service responses per second; anything beyond is only monitored
Block	A source may send at most <limit> unsolicited amplification-service responses per second; anything beyond is dropped
Quarantine	A source may send at most <limit> unsolicited amplification-service responses per second; a source that exceeds it is quarantined

INFO

Learning Lock Default: Off

Closes the rule to the learning engine. When the switch is turned on, the engine cannot change the limit and the mode of this rule; the rule is changed only manually from this window.

It is off by default. While the lock is on, an unlabeled padlock icon is displayed on the row, to the left of the pencil.

INFO

Limit per Second Default: 100

Determines how many responses per second will be allowed per source. Its default value is 100. Only an integer can be entered and the smallest value is 1; there is no upper bound.

INFO

Save

Saves the change made and puts it into force immediately. Only the changed fields are updated.

The Services Watched

The rule looks at the source port of the packet: this port says which service produced the response. Eight ports are watched and the list is fixed; it cannot be changed from the interface.

Port	Service	Why it is on the list
19	chargen	It answers a small request with a continuous character stream.
53	DNS	The answer to a query can be multiples of the request in size.
111	portmap	It returns the service mapping collectively.
123	NTP	On old servers the command that returns the client list produces a very large answer.
161	SNMP	Bulk queries return wide tables with a single request.
389	LDAP	The answers given to connectionless queries are large.
1900	SSDP	It is a local network discovery protocol; when it is opened to the internet it is used in amplification.
11211	memcached	It is the service with the highest amplification ratios measured.

Which response does the rule count as "unrequested"?

The rule looks only at the packets counted as new. A response that comes as the counterpart of a query the device itself sent does not visit this rule at all, because it is counted as part of an open exchange.

This distinction makes the rule usable: while the device continues to do its own name resolution or clock synchronization, the responses that come from the same ports and that have no counterpart are limited.

The rule covers the traffic passed through the device as well

Since the rule is applied before the routing decision, it is not limited to the packets directed at the device; the reflection traffic passed over the route table is counted and limited as well. The rule is written separately for IPv4 and IPv6.

The sources in the exemption list are taken outside the chain before the rule: these sources are neither limited nor taken into quarantine, and they are not written to the measurement either.

A measurement is produced in the monitoring mode as well

In the monitoring mode the rule is in force; only it has no result. The response rate per second of every source is measured; the highest source rate, the p95 value and the number of active sources are graphed together with the configured limit line on the Floods tab of the dashboard, but the traffic is not touched.

Pulling the limit to 1 turns the rule into a blanket block

When the limit is made 1, the threshold comparison falls out of the rule completely. In the enforcement mode all the new responses that come from the ports on the list are dropped; in the monitoring mode, on the other hand, since the rate counter is not set up, a real measurement is not produced, but the panel continues to be displayed and the series is displayed with a zero value.

Since the form accepts the value 1, this situation does not give an error message.

The learning engine can recommend the limit, and looks for the permission for the promotion

The engine can recommend the limit of this rule by looking at the past measurements. The value it recommends does not go below a certain base; this base limits only the recommendations of the engine, it does not limit the values entered manually.

The promotion of the rule from monitoring into enforcement, on the other hand, depends on the Mode Promotion permission. While the permission is off, the engine cannot recommend a promotion; while the rule is in the monitoring mode and there is no limit recommendation waiting to be applied, the Locked badge is displayed in the row.

Measurement and Dashboard

Feature	Its value
Panel tab	Floods
What is measured	The highest source rate, the p95 value, the number of active sources and the configured limit line
Quarantine panel	Yes
Dropped Traffic panel	Yes; it produces a value only in the enforcement modes

The quarantine and drop panels are displayed while the rule is off as well

The series on these two tabs are not filtered according to the mode of the rule; while the rule is off as well, they stay on the list with a zero value. Thus the list of the attack types does not change as the time range changes.

The panel on the Floods tab, on the other hand, depends on the mode: the panel of a rule whose mode is Off is not displayed.

Scope and Limits

INFO

• The rule protects the victim side. It does not prevent the device from being used as a reflector.
• The matching looks at the source port; the eight service ports are fixed and cannot be changed from the interface.
• Only the packets counted as new are measured; the responses that are the counterpart of the device's own query do not visit the rule.
• The rule covers the traffic passed through the device as well and is written for both IP versions.
• The source can be sent to quarantine; the quarantine duration is common with all the rules in the route table.
• In an untouched route table the rule is born in the monitoring mode.
• Pulling the limit to 1 turns the rule into a blanket block and this situation does not give an error.
• The promotion depends on the Mode Promotion permission. Detail: AI Learning Settings.
• The sources in the exemption list are not caught by the rule and are not written to its measurement.
• Editing requires modify permission in the Network area.