Reflection & Amplification

A VPS answers spoofed requests (DNS, NTP, memcached and others) with much larger replies, turning it into a weapon against a third party. Open resolvers and misconfigured services on customer VPSes are the usual cause. Frabs looks for replies far larger than the requests that triggered them.

What Frabs looks at

• DNS Amplification
• NTP Amplification
• Memcached Amplification
• CLDAP Amplification
• SSDP Amplification
• SNMP Amplification
• Chargen Amplification
• LDAP Amplification
• RPC Amplification
• WS-Discovery Amplification
• QOTD Amplification
• UDP Reflection

Switching it on or off

Open Protection and use this attack type's switch. To stop it for one VPS, choose Ignore for This VPS on one of its incidents.