UDP allows source and destination ports to be specified separately [1], so the attacker could just spoof the source port by setting it to 80 or 443. Unless the

UDP allows source and destination ports to be specified separately [1], so the attacker could just spoof the source port by setting it to 80 or 443. Unless the NTP server was specifically configured to not reply to well-known port numbers [2], this would result in the reply going to the spoofed port. [1] http://en.wikipedia.org/wiki/User_Datagram_Protocol#Packet_structure http://en.wikipedia.org/wiki/User_Datagram_Protocol#Packet_s... [2] Not sure if this is even possible