3 ms·

So can a server just close or move NTP ports to survive this and block default ports via firewall?

• FiloSottile 13y ago
  No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address). This allows to send a much bigger DDoS from a less powerful uplink. The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machines.
  • eli 13y ago
    On the plus side, I would imagine there are relatively limited number of NTP servers (at least compared to DNS when DDoS amplification attacks first caught on)
    • devicenull 13y ago
      You would wrong. Dedicated NTP servers yes, but there are things like routers, IPMI controllers, and firewalls that run the NTPD server. Even a bunch of linux distributions were shipping vulnerable daemons until a few weeks ago. Anyone that's done '<package manager> install ntp' has the potential to be vulnerable, depending on configuration.
• sp332 13y ago
  It's not a firewall problem. The target's server load will probably not even increase. But the pipe will be completely filled with bogus NTP responses. Legit traffic will barely trickle through whatever pipe you give it.