3 ms·
Unrelated to NTP, but I (network engineer at an ISP) have also recently observed a few DDoS attacks using the "rpcbind/portmapper" service being used for amplif
by jlgaddis 10y ago
Unrelated to NTP, but I (network engineer at an ISP) have also recently observed a few DDoS attacks using the "rpcbind/portmapper" service being used for amplification as well.
The first time I saw this was fairly recently but I've seen a few more instances since then, which may be an indication that this will become more widely used in the future.
Ensure that you've disabled unnecessary services and put a (default deny) firewall in front of your servers, for fuck's sake!
- zyztem 10y agoOh, FFS! BCP38 is 16 year old today. Please ensure that packets with spoofed source can not leave your network.
- kkirsche 10y agoWhile possible for customer networks you cannot do this for transit as you don't know the source address.
- NickNameNick 10y agoyou can still drop packets with invalid sources - private address ranges. reserved addresses, etc
- dgemm 10y agoTell that to China. Reflection attacks are still alive and well.
- toast0 10y agoI've seen a fair amount of chargen attacks; it's exciting because for whatever reason, the response packets are very large, so they're getting fragmented, but many people are trying to fix their outgoing chargen mess, and the first fragment (the one with the UDP port number) never arrives at my servers.