DDoS Attack Vectors
Interactive Periodic Table of Vectors
ATTACK COUNT
500,001+
50,001 - 500,000
0 - 50,000
- N/A Ds DNS 2
- 160:1 Dn ○○○●● DNS Amp 3
- N/A Im ICMP 4
- 556.9:1 Np ○○○○● NTP Amp 5
- N/A Ta TCP ACK 6
- N/A Tr TCP RST 7
- N/A Ts TCP SYN 9
- 3:1 Tk TCP SYN/ACK Amp 10
- 3.8:1 Bt ○○○○● BitTorrent Amp 11
- 1,000:1 Ch ○○○○● Chargen Amp 12
- 56.89:1 Cd ○○○○● CLDAP Amp 13
- 10:1 Ik ○○○○● ISAKMP/IKE Amp 15
- 13.5:1 Lt ○○●●● L2TP Amp 16
- 4.35:1 Md ○○○○● mDNS Amp 17
- 51,200:1 Mc ○○○○● Memcached Amp 18
- 25:1 Mq ○○○○● MSSQLRS Amp 19
- 3:1 Nb ○○○○● NetBIOS Amp 21
- 33.9:1 Ov ○○○●● OpenVPN Amp 22
- 6.3:1 Sn ○○○●● SNMP Amp 23
- 30.8:1 Ss ○○○●● SSDP Amp 24
- 3.32:1 St ○○○○● STUN Amp 25
- N/A Tn TCP NULL 28
- 2,464:1 Un ○○○○● Unreal-Tournament Amp 29
- 14:1 Ve ○○○○● VSE Amp 30
- 500:1 Wd ○○○○● WS-DD Amp 31
- 35.5:1 Ar ○○○○● ARMS Amp 34
- 120:1 Bc ○○○○● BACnet Amp 35
- 5.7:1 Ci ○○○○● Citrix-ICA Amp 36
- 34:1 Cp ○○○○● COAP Amp 37
- 37.34:1 Dt D/TLS 39
- 25.68:1 Di ○○○○● DHCPDiscover Amp 40
- N/A Ht HTML5 41
- N/A In IP NULL 42
- 1.1:1 Ip ○○○○● IPMI Amp 43
- N/A Iv IPv4 Protocol 0 45
- 5.6:1 Jk ○○○○● Jenkins Amp 46
- 700,000:1 Mh ○○●●● MBHTTP Amp 47
- 4.68:1 Pm ○○○○● PMSSDP Amp 48
- 140.3:1 Qd ○○○○● QOTD Amp 49
- 63.9:1 Qk ○○○○● Quake Amp 51
- Variable Qc ○○○○● Quic Amp 52
- 85.9:1 Rd ○○○○● RDP Amp 53
- 134.24:1 Ri ○○○○● RIPv1 Amp 54
- 29:1 Rc ○○○●● rpcbind/portmap Amp 55
- 30.7:1 Se ○○○○● Sentinel Amp 56
- 10:1 Sp ○○●●● SIP Amp 57
- 2,200:1 Sl ○○○○● SLP Amp 58
- 46.5:1 Tf ○○○●● TFTP Amp 59
- 4,294,967,296:1 Tp ○○○○● TP240 PhoneHome Amp 60
- 4:1 Ub ○○○○● Ubiquiti Amp 61
Attack Count
500,001+
50,001 - 500,000
0 - 50,000
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
DNS
Programmatically generated DNS queries mainly intended to overwhelm authoritative DNS servers; recursive DNS servers can also be targeted, and can be negatively impacted if used to reflect DNS query floods toward targeted authoritative DNS servers. Queried Resource Records (RRs) can be pseudorandomly generated (DNS Water Torture), or chosen from a dictionary of tens of thousands of plausible-sounding labels (i.e, the Dyn attack).
Amplification Number
N/A
Number of Attacks
959230
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
DNS Amp
A DNS reflection/amplification DDoS attack is a common two-step DDoS attack in which the attacker manipulates open DNS servers.
Amplification Number
160:1
Number of Attacks
2340548
Reflectors/Amplifiers
1192570
Port Number
53
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
ICMP
Programmatically generated ICMP packets intended to consume link bandwidth (bps)/throughput (pps), as well as the capacity of targeted nodes to generate ICMP responses in the case of ICMP Echo Request (i.e., ping) floods. ICMP floods are measured in both bits-per-second (bps) and packets-per-second (pps), and are a form of volumetric DDoS attack.
Amplification Number
N/A
Number of Attacks
1527733
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
NTP Amp
Misconfigured Network Time Protocol (NTP) servers that expose abusable administrative functions to the internet can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
556.9:1
Number of Attacks
527985
Reflectors/Amplifiers
6935
Port Number
123
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP ACK
Programmatically generated TCP ACK packets primarily intended to overwhelm the state-tables of stateful firewalls, load-balancers, IPS devices, and so forth by forcing them to perform multiple simultaneous lookups for nonexistent connections. Most ACK floods are spoofed. ACK floods are primarily measured in packets-per-second (pps), and are a volumetric form of DDoS attack.
Amplification Number
N/A
Number of Attacks
2812992
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP RST
Programmatically generated TCP RST packets primarily intended to overwhelm the state-tables of stateful firewalls, load balancers, IPS devices, and so forth by forcing them to perform multiple simultaneous lookups for nonexistent connections. Most RST floods are spoofed. RST floods are primarily measured in packets-per-second (pps) and are a volumetric form of DDoS attack.
Amplification Number
N/A
Number of Attacks
1383928
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP SYN
Programmatically generated TCP SYN packets intended to overwhelm the TCP stacks of targeted hosts, consuming their capacity to instantiate new TCP connections for legitimate clients. SYN floods can also exhaust the state-tables of stateful firewalls, load balancers, IPS devices, et al. Most SYN floods are spoofed. SYN floods are primarily measured in packets-per-second (pps), and are both a volumetric and a connection-oriented form of DDoS attacks.
Amplification Number
N/A
Number of Attacks
1742635
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP SYN/ACK Amp
Any node that runs a TCP-based service such as web servers, SMTP mail relays, and so forth can potentially be leveraged to launch TCP reflection/amplification DDoS attacks.
Amplification Number
3:1
Number of Attacks
1481928
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
BitTorrent Amp
Nodes running older versions of BitTorrent P2P file-sharing applications can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
3.8:1
Number of Attacks
75583
Reflectors/Amplifiers
96890
Port Number
6881
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Chargen Amp
Systems running the legacy character-generator (chargen) network test facility can be abused to launch reflection/amplification DDoS attacks. Most chargen reflectors/amplifiers are IoT devices, which often have such abusable legacy services running by default.
Amplification Number
1,000:1
Number of Attacks
53208
Reflectors/Amplifiers
13620
Port Number
19
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
CLDAP Amp
Unsecured Connectionless Lightweight Directory Access Protocol (CLDAP) services can be leveraged to launch reflection/amplification DDoS attacks. Most abusable CLDAP reflectors/ampliifers are Microsoft Windows servers that have been unwisely exposed to the public internet.
Amplification Number
56.89:1
Number of Attacks
77800
Reflectors/Amplifiers
12808
Port Number
389
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
ISAKMP/IKE Amp
Misconfigured VPN servers and concentrators supporting the ISAKMP/IKE key-exchange methodology can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
10:1
Number of Attacks
120725
Reflectors/Amplifiers
19170
Port Number
500
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
L2TP Amp
Misconfigured VPN servers and concentrators supporting the L2TP protocol can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
13.5:1
Number of Attacks
180335
Reflectors/Amplifiers
2003512
Port Number
1701
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
mDNS Amp
Internet-exposed nodes running misconfigured, abusable mDNS services can be leveraged to launch reflection/amplication DDoS attacks.
Amplification Number
4.35:1
Number of Attacks
107509
Reflectors/Amplifiers
188742
Port Number
5353
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Memcached Amp
Misconfigured, internet-exposed memcached database-caching servers can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
51,200:1
Number of Attacks
102363
Reflectors/Amplifiers
171
Port Number
11211
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
MSSQLRS Amp
Abusable, internet-exposed Microsoft SQL Server nodes running the SQL Server Reporting Service can be leveraged to launch reflection/amplification attacks.
Amplification Number
25:1
Number of Attacks
109328
Reflectors/Amplifiers
79866
Port Number
1434
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
NetBIOS Amp
Network Basic Input/Output System (NetBIOS) provides services related to the session layer of the OSI model that allow applications on separate computers to communicate over a local area network. An attacker can cause a victim's machine to refuse all NetBIOS network traffic, resulting in a denial of service.
Amplification Number
3:1
Number of Attacks
51371
Reflectors/Amplifiers
419286
Port Number
137
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
OpenVPN Amp
OpenVPN servers and concentrators running outdated software can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
33.9:1
Number of Attacks
62622
Reflectors/Amplifiers
980267
Port Number
1194
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SNMP Amp
Routers, layer-3 switches, Wi-Fi access points, servers, and other internet-connected devices running the SNMPv2 management protocol, and which have been misconfigured to expose it to the internet with default credentials, can be leveraged to launch reflection/amplification attacks.
Amplification Number
6.3:1
Number of Attacks
92059
Reflectors/Amplifiers
1077893
Port Number
161
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SSDP Amp
Consumer-grade broadband access routers that expose Simple Service Discovery Protocol (SSDP) to the internet can be leveraged to launch SSDP reflection/amplification attacks.
Amplification Number
30.8:1
Number of Attacks
153128
Reflectors/Amplifiers
813713
Port Number
1900
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
STUN Amp
Nodes running the STUN protocol used to provide dynamic mapping of NATted private IP addresses to publicly routable IP addresses can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
3.32:1
Number of Attacks
438345
Reflectors/Amplifiers
153945
Port Number
3478,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TCP NULL
Programmatically generated TCP packets with no flags and no actual payload; they are typically padded with either zeroes or pseudo-random characters. TCP Null Floods are primarily intended to overwhelm the TCP/IP stacks of targeted nodes with payloadless packets, as well as consume link capacity.
Amplification Number
N/A
Number of Attacks
60970
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Unreal-Tournament Amp
Multiplayer game servers running deprecated versions of the Unreal Tournament online gaming protocol can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
2,464:1
Number of Attacks
53888
Reflectors/Amplifiers
1803
Port Number
7777-7788
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
VSE Amp
Multiplayer game servers running deprecated versions of the Valve Steam Engine (VSE) online gaming protocol can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
14:1
Number of Attacks
57018
Reflectors/Amplifiers
17849
Port Number
27015-27021,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
WS-DD Amp
Misconfigured, internet-exposed nodes running the Web Services Dynamic Discovery (WS-DD) protocol can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
500:1
Number of Attacks
57318
Reflectors/Amplifiers
18756
Port Number
3702
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
ARMS Amp
Internet-exposed Apple computers running older versions of the Apple Remote Management System (ARMS) protocol can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
35.5:1
Number of Attacks
30499
Reflectors/Amplifiers
5132
Port Number
3283
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
BACnet Amp
Internet-exposed servers and IoT devices running the BACNet HVAC management system protocol can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
120:1
Number of Attacks
2144
Reflectors/Amplifiers
15578
Port Number
47808
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Citrix-ICA Amp
Citrix Independent Computing Architecture (Citrix ICA) is a proprietary protocol for an application server system. Designed by Citrix Systems, it is not bound to any single platform and lays down specification for passing data between server and clients. Citrix ICA includes a server software component, a network protocol component, and a client software component. The Citrix ICA protocol has been used as an attack vector for DDoS attacks.
Amplification Number
5.7:1
Number of Attacks
1969
Reflectors/Amplifiers
3853
Port Number
1604
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
COAP Amp
Misconfigured Constrained Application Protocol (CoAP) M2M speakers can be leveraged to launch reflection/amplification DDoS attacks. Most abusable CoAP reflectors/amplifiers are embedded IoT devices connected to the internet over wireless broadband carriers. Like other UDP-based protocols, CoAP can be exploited to perform UDP reflection/amplification DDoS attacks.
Amplification Number
34:1
Number of Attacks
33366
Reflectors/Amplifiers
233260
Port Number
5683
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
D/TLS
Improperly implemented D/TLS servers and load-balancers can be leveraged to launch reflection/amplification DDoS attacks. Most D/TLS reflectors/amplifiers are hardware load balancers running outdated software.
Amplification Number
37.34:1
Number of Attacks
N/A
Reflectors/Amplifiers
N/A
Port Number
4443
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
DHCPDiscover Amp
Internet-exposed DVRs and other types of IoT devices running the DHCPDiscover management protocol can be leveraged to launch reflection/amplification DDoS attacks (note that despite its name, DHCPDiscover is unrelated to the DHCP IP address-management protocol).
Amplification Number
25.68:1
Number of Attacks
14239
Reflectors/Amplifiers
64352
Port Number
37810
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
HTML5
HTML5 (Hypertext Markup Language) is used for structuring and presenting content on the World Wide Web. The HTML5 language's ping attribute is used by websites as a mechanism to notify a website if a user follows a given link on a page. It has also been utilized as a DDoS attack vector to overwhelm targeted victims.
Amplification Number
N/A
Number of Attacks
N/A
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
IP NULL
Programmatically generated IP packets with no actual payload; they are typically padded with either zeroes or pseudo-random characters. IP Null Floods are primarily intended to overwhelm the TCP/IP stacks of targeted nodes with payloadless packets, as well as to consume link bandwidth (bps)/throughput (pps). IP Null floods are measured in both bits-per-second (bps) and packets-per-second (pps), and are a volumetric form of DDoS attack.
Amplification Number
N/A
Number of Attacks
29950
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
IPMI Amp
Internet-exposed Baseband Management Controller (BMC) server management subsystems running the RMCP protocol can be leveraged to launch reflection/amplification attacks. These combined suites of hardware and software are collectively referred to as Intelligent Platform Management Interface (IPMI) systems.
Amplification Number
1.1:1
Number of Attacks
963
Reflectors/Amplifiers
54048
Port Number
623
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
IPv4 Protocol 0
Programmatically generated IPv4 Protocol 0 packets intended to consume link bandwidth/throughput, as well as the capacity of targeted nodes to process incoming packets. IPv4 Protocol 0 is an invalid protocol number, but is forwarded by most routers and layer-3 switches. IPv4 Protocol 0 floods are measured in both bits-per-second (bps) and packets-per-second (pps), and are a form of volumetric DDoS attack.
Amplification Number
N/A
Number of Attacks
23880
Reflectors/Amplifiers
N/A
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Jenkins Amp
Servers running obsolete versions of the popular Jenkins automation suite can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
5.6:1
Number of Attacks
3856
Reflectors/Amplifiers
29182
Port Number
33848
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
MBHTTP Amp
Large-scale state-sponsored, ISP-operated, and enterprise-run web censorship systems that do not properly establish a TCP 3-way handshake prior to transmitting policy-violation responses to offending clients can be leveraged to launch reflection/ampification DDoS attacks.
Amplification Number
700,000:1
Number of Attacks
N/A
Reflectors/Amplifiers
3347528
Port Number
N/A
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
PMSSDP Amp
Plex Media Server nodes running outdated software and exposed to the public internet can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
4.68:1
Number of Attacks
332
Reflectors/Amplifiers
59808
Port Number
32410,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
QOTD Amp
The legacy Quote-of-the-Day (QotD) network entertainment service can be leveraged to launch reflection/amplification DDoS attacks. It is mainly found today on IoT devices running insecure default configurations that expose abusable, outdated services to the internet at large.
Amplification Number
140.3:1
Number of Attacks
2026
Reflectors/Amplifiers
15483
Port Number
17
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Quake Amp
Quake game servers running legacy, outdated multiplayer software can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
63.9:1
Number of Attacks
4783
Reflectors/Amplifiers
1215
Port Number
27960,
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Quic Amp
A limited population of misconfigured QUIC servers can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
Variable
Number of Attacks
N/A
Reflectors/Amplifiers
458409
Port Number
443
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
RDP Amp
Misconfigured, abusable Microsoft Windows Remote Desktop Protocol (RDP) servers that are exposed to the internet can be leveraged to launch reflection/amplification DDoS attacks.
Amplification Number
85.9:1
Number of Attacks
14430
Reflectors/Amplifiers
4684
Port Number
3389
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
RIPv1 Amp
Nodes that expose the deprecated RIPv1 routing protocol to the internet can be abused to launch reflection/amplification attacks.
Amplification Number
134.24:1
Number of Attacks
24296
Reflectors/Amplifiers
270697
Port Number
520
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
rpcbind/portmap Amp
Misconfigured servers that expose the rpcbind/portmapper service to the internet can be leveraged to launch reflection/amplification attacks.
Amplification Number
29:1
Number of Attacks
32810
Reflectors/Amplifiers
1447886
Port Number
111
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Sentinel Amp
SPSS statistical software-licensing servers running outdated software can be abused to launch Sentinel reflection/amplification DDoS attacks.
Amplification Number
30.7:1
Number of Attacks
2233
Reflectors/Amplifiers
1094
Port Number
5093
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SIP Amp
Misconfigured, internet-exposed Session Border Controllers (SBCs) and voice-over-IP (VoIP) PBXes can be abused to launch Session Initiation Protocol (SIP) reflection/amplification DDoS attacks.
Amplification Number
10:1
Number of Attacks
41619
Reflectors/Amplifiers
3065198
Port Number
5060
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
SLP Amp
Misconfigured, publicly exposed Session Location Protocol (SLP) responders can be leveraged to launch reflection/amplification attacks. Many abusable SLP responders are actually internet-exposed print servers.
Amplification Number
2,200:1
Number of Attacks
33280
Reflectors/Amplifiers
24506
Port Number
427
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TFTP Amp
Misconfigured, publicly exposed Trivial File Transfer Protocol (TFTP) servers can be leveraged to launch reflection/amplification attacks. Many abusable TFTP servers are actually routers or other network infrastructure devices.
Amplification Number
46.5:1
Number of Attacks
24558
Reflectors/Amplifiers
1004579
Port Number
69
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
TP240 PhoneHome Amp
A test facility present in unpatched Mitel VoIP gateways running deprecated software versions can be abused to launch reflection/amplification DDoS attacks with a record-breaking amplification factor of 4,294,967,296:1.
Amplification Number
4,294,967,296:1
Number of Attacks
6604
Reflectors/Amplifiers
3701
Port Number
10074
500,001+ Attacks
50,001 - 500,000 Attacks
0 - 50,000 Attacks
Ubiquiti Amp
Some Ubiquiti wireless access devices running outdated software and that expose their managagment protocol to the public internet can be abused to launch reflection/amplification DDoS attacks.
Amplification Number
4:1
Number of Attacks
24036
Reflectors/Amplifiers
23126
Port Number
10001
