{
  "schemaVersion": "1.0",
  "dataset": "amplification-factors",
  "title": "UDP reflection and amplification factors",
  "description": "Bandwidth amplification factors for reflection-capable UDP protocols, transcribed from CISA alert TA14-017A. A factor is a measurement under stated conditions, not a constant — read the methodology note.",
  "lastUpdated": "2026-08-15",
  "license": "Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.",
  "sources": [
    {
      "id": "cisa-ta14-017a",
      "title": "Alert TA14-017A: UDP-Based Amplification Attacks",
      "publisher": "CISA (US Cybersecurity and Infrastructure Security Agency)",
      "url": "https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks",
      "publishedDate": "2014-01-17",
      "accessedDate": "2026-08-15",
      "notes": "Last revised 18 December 2019. Every factor and command in this table is transcribed from the alert; figures are not averaged or altered."
    }
  ],
  "changelog": [
    {
      "date": "2026-08-15",
      "note": "Initial release: 19 protocols transcribed from TA14-017A."
    }
  ],
  "rowCount": 19,
  "data": [
    {
      "protocol": "DNS",
      "reportedFactor": "28 to 54",
      "vulnerableCommand": "see TA13-088A",
      "currentRelevance": "Still among the most abused; TCP support (RFC 9210) and response-rate limiting are the standard countermeasures."
    },
    {
      "protocol": "NTP",
      "reportedFactor": "556.9",
      "vulnerableCommand": "see TA14-013A",
      "currentRelevance": "The monlist command drove a wave of very large attacks; largely mitigated by patching, but the factor is why it mattered."
    },
    {
      "protocol": "SNMPv2",
      "reportedFactor": "6.3",
      "vulnerableCommand": "GetBulk request",
      "currentRelevance": "Modest factor; abuse depends on exposed community strings."
    },
    {
      "protocol": "NetBIOS",
      "reportedFactor": "3.8",
      "vulnerableCommand": "Name resolution",
      "currentRelevance": "Low factor; relevant mainly on exposed legacy Windows services."
    },
    {
      "protocol": "SSDP",
      "reportedFactor": "30.8",
      "vulnerableCommand": "SEARCH request",
      "currentRelevance": "Consumer UPnP devices make this a persistent source of mid-size reflection."
    },
    {
      "protocol": "CharGEN",
      "reportedFactor": "358.8",
      "vulnerableCommand": "Character generation request",
      "currentRelevance": "High factor from an obsolete service; should not be reachable at all on a modern network."
    },
    {
      "protocol": "QOTD",
      "reportedFactor": "140.3",
      "vulnerableCommand": "Quote request",
      "currentRelevance": "Obsolete diagnostic service; disable it."
    },
    {
      "protocol": "BitTorrent",
      "reportedFactor": "3.8",
      "vulnerableCommand": "File search",
      "currentRelevance": "Low factor; abuse tied to DHT and peer-exchange behaviour."
    },
    {
      "protocol": "Kad",
      "reportedFactor": "16.3",
      "vulnerableCommand": "Peer list exchange",
      "currentRelevance": "P2P network reflection; niche."
    },
    {
      "protocol": "Quake Network Protocol",
      "reportedFactor": "63.9",
      "vulnerableCommand": "Server info exchange",
      "currentRelevance": "Game-server reflection; relevant to gaming-sector operators specifically."
    },
    {
      "protocol": "Steam Protocol",
      "reportedFactor": "5.5",
      "vulnerableCommand": "Server info exchange",
      "currentRelevance": "Low factor; gaming infrastructure."
    },
    {
      "protocol": "Multicast DNS (mDNS)",
      "reportedFactor": "2 to 10",
      "vulnerableCommand": "Unicast query",
      "currentRelevance": "Low factor, but widely exposed on misconfigured devices; see CERT/CC VU#550620."
    },
    {
      "protocol": "RIPv1",
      "reportedFactor": "131.24",
      "vulnerableCommand": "Malformed request",
      "currentRelevance": "High factor from a legacy routing protocol; documented in an Akamai PLXsert advisory."
    },
    {
      "protocol": "Portmap (RPCbind)",
      "reportedFactor": "7 to 28",
      "vulnerableCommand": "Malformed request",
      "currentRelevance": "Documented by Level 3 Threat Research in 2015; relevant where RPC is internet-exposed."
    },
    {
      "protocol": "LDAP",
      "reportedFactor": "46 to 55",
      "vulnerableCommand": "Malformed request",
      "currentRelevance": "Directory-service reflection reported by Corero in 2016."
    },
    {
      "protocol": "CLDAP",
      "reportedFactor": "56 to 70",
      "vulnerableCommand": "not stated",
      "currentRelevance": "Reported by Netlab 360 in 2017 as the third most common reflection vector after DNS and NTP."
    },
    {
      "protocol": "TFTP",
      "reportedFactor": "60",
      "vulnerableCommand": "not stated",
      "currentRelevance": "High factor; TFTP should never be internet-reachable."
    },
    {
      "protocol": "Memcached",
      "reportedFactor": "10,000 to 51,000",
      "vulnerableCommand": "not stated",
      "currentRelevance": "The extreme case: an unauthenticated, internet-exposed cache. Drove record-setting attacks in 2018; the fix is not exposing it (UDP/TCP 11211)."
    },
    {
      "protocol": "WS-Discovery",
      "reportedFactor": "10 to 500",
      "vulnerableCommand": "not stated",
      "currentRelevance": "Wide range; exploited from 2019 against exposed devices on TCP/UDP 3702."
    }
  ]
}