Reflection/Amplification attacks generally use services that do not validate the source IP of incoming packets (DNS, NTP, LDAP, etc). The attacker first generates a trigger packet such that the source IP points towards the victim and then sends it to these services, resulting in a large reply (amplification) sent towards the victim. (see https://www.netscout.com/what-is-ddos/volumetric-attacks for more details). TCP Reflection/Amplification attacks work in a similar fashion, sending spoofed TCP SYN packets to the reflector and relying on the reflector sending multiple SYN-ACK replies to the victim. The number of replies sent varies based on the OS used. For example, Linux devices send 3 replies while Windows devices send 5 by default.