Reflective DDoS attacks do not send traffic directly at the target host. Instead, they usually spoof the originating IP addresses and send the requests at the reflectors. These reflectors (usually routers or high-powered servers with a large amount of network resources at the their disposal) then reply to the spoofed targeted traffic by sending loads of data to the final target. How would you detect these reflectors on your network?

		run vulnerability scanner on your network to detect these reflectors
		look for the banner text by running Zobbie Zappers tools
		scan the network using NMAP for the services used by these reflectors
		run floodnet tool to detect these reflectors