Agreed. As I see it there are two main design methods for overcoming this issue.

The first is better for 'anonymous' services; require the client to send a packet of the same size as the buffer they want to receive. It's network in-efficient but for small requests better than the delay in setting up an actual session. It eliminates the chance of amplification attacks.

The second is to establish /some/ kind of session. This might be as 'simple' as logging in, or it could just involve a few round trip communications that indicate the client /is/ listening to server replies. That eliminates every DDoS style except for a man in the middle capable amplification vectors; yet if MitM is possible then why bother with DDoS.

I guess we are throwing UDP out the windows all together now? ;)

Won't somebody think of the routers?!

Header size is 8-20 (without options) and if you read the article closelyer you'll see the total packet size was 480ish.

I dont know how you are getting 21/461 = 22 ?

I was being handwavy with the values (adding a fixed 20 bytes for header), but let's try something more precise:

    the average packet size was 483 bytes (average data
    length = 441 bytes)

So header size is 42 bytes (483 - 441). Assuming the request uses the same headers, we have 483 / (1+42) = 11.23 amplification.

My point is: this is important, but not a 440x amplification attack.