> Amplification makes a DDoS bigger, but isn't what makes it a DDoS. I know, but large botnets like MIRAI and similar usually take advantages of how UDP floodi

> Amplification makes a DDoS bigger, but isn't what makes it a DDoS. I know, but large botnets like MIRAI and similar usually take advantages of how UDP flooding works, because TCP RST packets don't scale as well. I was just mentioning that because ISPs could easily get rid of most UDP-based DDoS attacks if they would watch their networks' packet sources (what they're doing anyways). Usually it's literally just a comparison of IANA assigned IP ranges (of source+victim being inside or outside), and if they're mismatching, it's very likely to be a UDP flooding attack.