NTP server misuse and abuse

Misuse of a <a href="/facts/Network_Time_Protocol/vS21KqT5">Network Time Protocol</a> (NTP) server ranges from flooding it with traffic (effectively a <a href="/facts/DDoS/6nkoK02J">DDoS</a> attack) or violating the server's access policy or the NTP <a href="http://support.ntp.org/Servers/RulesOfEngagement">rules of engagement</a>. One incident was branded NTP vandalism in an <a href="/facts/Open_letter/xX1W5GWm">open letter</a> from <a href="/facts/Poul-Henning_Kamp/RJYWIRCS">Poul-Henning Kamp</a> to the <a href="/facts/Router_(computing)/Nh5cIyVf">router</a> manufacturer <a href="/facts/D-Link/tmrcqckb">D-Link</a> in 2006. This term has later been extended by others to retroactively include other incidents. There is, however, no evidence that any of these problems are deliberate vandalism. They are more usually caused by shortsighted or poorly chosen default configurations.
A <a href="http://networktimefoundation.org/ntp-winter-2013-network-drdos-attacks/">deliberate form of NTP server abuse</a> came to note at the end of 2013, when NTP servers were used as part of <a href="/facts/Denial-of-service_attack/6nkoK02J">amplification denial-of-service attacks</a>. Some NTP servers would respond to a single "monlist" UDP request packet, with packets describing up to 600 associations. By using a request with a <a href="/facts/IP_address_spoofing/W7Ba2do5">spoofed IP address</a> attackers could direct an amplified stream of packets at a network. This resulted in one of the largest distributed denial-of-service attacks known at the time.

NTP server misuse and abuse open-in-new

NTP server misuse and abuse