But most volumetric attacks are reflection attacks, which would be impossible if BCP-38 were implemented everywhere. Direct non-reflection volumetric attacks of significant magnitude (say above 40Gbps) are almost non-existent.