Originally posted by aldra
easy way to visualise it: your ip address is 1.2.3.4. your target is 5.6.7.8.
You send a message to an NTP server saying "HI I'm 5.6.7.8 please send me the time"
the NTP server connects back to 5.6.7.8 and sends the time.
you send this to like 500 NTP servers and that's a significant amount of data hitting 5.6.7.8 - the request for the time information is much shorter than the actual time data.
With TCP you cannot effectively spoof your IP address; when you connect to something and ask for data it WILL send it back to you.
With UDP there's no way for them to verify that you're not 5.6.7.8 if you say you are.
This will work with most UDP-based services, NTP and DNS are the most popular ones for reflection
i get it, yeah. but if the target is bigger than all the NTP servers then its them that will be dossed instead of the target. imagine trying to bring amazon or google down. we aborted that during operation payback in 2011 because it wasnt doing shit.