There is a probably a consumer device that has a GRE listener running, and it is possible to send it a small packet, and it will return back some sort of error

There is a probably a consumer device that has a GRE listener running, and it is possible to send it a small packet, and it will return back some sort of error response. So classic amplification. Thought given the moderate amount of traffic, maybe it isn't a hugely effective DDoS method. Even if a consumer device doesn't use GRE, it doesn't mean it isn't there. GRE is often included in Linux kernels.