How AWS Mitigated a Record-Breaking 2.3 Tbps DDoS Attack in February 2020

This article is based on information originally reported by SiliconAngle and details disclosed in the AWS Shield Threat Landscape Report for Q1 2020.

The Record-Breaking Attack

In its Q1 2020 AWS Shield Threat Landscape Report, Amazon Web Services disclosed that it had successfully mitigated a distributed denial-of-service (DDoS) attack peaking at 2.3 terabits per second (Tbps) in February 2020. At the time of disclosure, this was the largest DDoS attack ever publicly recorded. The attack lasted approximately three days, and AWS services remained online throughout, with no customer-visible disruption reported.

Attack Vector: CLDAP Reflection

The attack used a technique known as a Connection-less Lightweight Directory Access Protocol (CLDAP) reflection attack. Understanding how this works is important for any team designing DDoS-resilient infrastructure.

How CLDAP Reflection Works

1. Spoofed request: The attacker sends a CLDAP query to a publicly accessible LDAP server, but forges the source IP address to be the victim’s IP address.
2. Amplified response: The LDAP server sends its response — which is significantly larger than the original request — to the victim’s IP address rather than the attacker’s.
3. Volumetric flood: By repeating this across thousands of misconfigured LDAP servers simultaneously, attackers generate a massive flood of traffic directed at the target.

The amplification factor in CLDAP attacks can be very high, meaning attackers with relatively modest bandwidth can generate disproportionately large attack volumes. This makes CLDAP reflection particularly efficient as a DDoS vector.

Second Most Common Vector: SYN Flood Attacks

The AWS Q1 2020 report identified SYN flood attacks as the second most common DDoS vector observed during the quarter. A SYN flood exploits the TCP three-way handshake:

• The attacker sends a large number of TCP SYN packets to a target server, typically with spoofed source IP addresses.
• The server responds to each SYN with a SYN-ACK packet, allocating state for each half-open connection while waiting for the final ACK.
• Because the ACK never arrives (the source IP is fake), the server’s connection table fills up with half-open connections.
• Legitimate clients are unable to establish new connections, effectively taking the service offline.

Putting the Scale in Context

While the 2.3 Tbps headline figure is striking, the AWS report provides important context for everyday operations:

• Smaller volumetric events dominate in practice. According to the report, the 99th-percentile network volumetric event in Q1 2020 peaked at 43 Gbps — well below the record attack but still large enough to disrupt most unprotected origins.
• Multi-vector attacks are common. Whether at record scale or routine scale, attackers routinely combine techniques: ACK floods, SYN floods, UDP floods, NTP amplification, TCP resets, SSDP reflection, and CLDAP reflection are all frequently combined.

Historical Record Context

Before the AWS incident, the publicly known record for a DDoS attack was a 1.2 Tbps attack targeting GitHub in March 2018, which also used memcached amplification. The AWS attack nearly doubled that figure.

Around the same period, a separate report by Fahmida Y. Rashid at Duo Security detailed a DDoS attack against a web host protected by Akamai Technologies that peaked at 1.44 Tbps — the largest Akamai had mitigated at that time. That attack lasted approximately 90 minutes, with smaller follow-up attacks continuing afterward. It similarly involved volumetric floods using ACK, SYN, UDP, NTP, TCP reset, and SSDP packets, along with CLDAP reflection — underlining how attackers routinely combine multiple vectors.

What This Means for DevOps and Cloud Teams

The AWS Q1 2020 report and this attack carry several practical lessons:

• Managed DDoS protection is not optional at scale. Absorbing 2.3 Tbps requires infrastructure and scrubbing capacity that no single organization can self-provision cost-effectively. Managed services like AWS Shield Advanced, Akamai Prolexic, or Cloudflare Magic Transit exist specifically for this purpose.
• Plan for the 99th percentile, not just the average. Even at 43 Gbps, an unprotected origin would be overwhelmed. Use always-on traffic baseline analysis to detect anomalies early.
• Patch and restrict LDAP/CLDAP exposure. CLDAP reflection attacks depend on misconfigured, publicly reachable LDAP servers. Audit your network perimeter to ensure LDAP (UDP port 389) is not exposed to the public internet unnecessarily.
• Layer your defenses. Because multi-vector attacks are common, effective DDoS response requires protection at the network layer (L3/L4) and the application layer (L7) simultaneously.
• Review threat reports regularly. Cloud providers publish periodic threat landscape reports. Reading them keeps your team aware of evolving attack patterns and helps prioritize defensive investments.

Further Reading

For teams responsible for cloud infrastructure security, the following resources are worth reviewing:

• AWS Shield Threat Landscape Reports (published periodically by AWS Security)
• CISA guidance on DDoS attack mitigations
• IETF documentation on CLDAP and UDP-based amplification vectors