A lot of these types of attack use amplification attacks (https://www.us-cert.gov/ncas/alerts/TA13-088A), often a carelessly-configured time server or name server, where only a small number of hosts are needed to wreak havoc.