Understanding and mitigating NTP-based DDoS attacks
Jan 9, 2014John Graham-Cumming
Summary
This post introduces NTP-based DDoS attacks as a new threat vector, explaining their mechanism of reflection and amplification. It details how the NTP protocol, specifically the 'monlist' command, can be exploited for these attacks. The post also provides guidance on how to mitigate these attacks by configuring NTP servers and firewalls, and by implementing BCP-38 to prevent source IP spoofing. Cloudflare's role in defending against these attacks is highlighted.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack