[Ntp] NTP DDoS Attacks (Was: Re: NTPv5 Requirements vs. NTPv5 Spec)

[Richard Laager <[e-mail]>]

On 2025-06-25 03:48, Miroslav Lichvar wrote:
> Do you have a capture of the traffic you could check? It would be very
> interesting to see what modes and commands are now used in the
> amplification attacks.

I have a capture showing NTPv2 mode 7 responses (to a request code 42, 
MON_GETLIST_1) from implementation 3 (which Wireshark decodes as 
"XNTPD"). I don't have any other captures, unfortunately.

It is my view that NTP mode 6 & mode 7 queries have no place on the 
general Internet. I block them at the network edge, and I wish more 
carriers, especially big carriers, would do so. However, blocking them 
(without blocking legitimate NTP traffic, of course) is tricky. In the 
carrier routing context (i.e. not a "firewall" device doing CPU-based 
filtering), this would generally require using user-defined filters 
(UDF), of which you might get one or two in total (chassis-wide). And 
even then, this would come at the expense of other packet matching 
criteria. So, I understand why carriers don't.

-- 
Richard