NTP Amplification Attacks Explained: Reflection and DDoS for Security+

An NTP amplification attack is a distributed denial-of-service technique that turns public time servers into unwitting weapons. It is the textbook example of a reflection and amplification attack, and that is exactly why exams like it.

The attacker sends a small request with a forged source address. The server sends a much larger reply to the victim. Repeat across thousands of servers and the victim drowns in traffic that never came from the attacker.

Why NTP Works So Well for This

Three properties combine, and all three are needed.

NTP runs over UDP, on port 123. UDP is connectionless — there is no handshake, so the server has no way to confirm that the address in the request is the address that sent it. That is what makes spoofing possible, and spoofing is what makes reflection possible.

NTP is everywhere and rarely blocked. Time synchronization is essential infrastructure; Kerberos authentication, certificate validation, and log correlation all break when clocks drift. Nobody blocks NTP.

One legacy command amplifies enormously. The monlist command — MON_GETLIST_1 in older ntpd builds — asks a server to return the last 600 hosts that contacted it. The request is about 8 bytes of payload. The response can be roughly 48 KB, split across many packets.

That gives an amplification factor in the region of 200:1 up to around 550:1, which is among the highest of any known reflector. A modest 1 Mbps of spoofed requests becomes hundreds of megabits at the victim.

How the Attack Runs

1. The attacker scans the internet for NTP servers that still answer monlist — historically hundreds of thousands of them.
2. They craft small NTP requests with the source IP forged to the victim's address.
3. Those requests go out to the reflector list, often from a botnet to spread the origin.
4. Each server dutifully sends its large response to the victim, because that is where the packets appear to have come from.
5. The victim's link saturates. From their perspective the traffic arrives from thousands of legitimate, well-behaved time servers.

Note what the attacker gains beyond volume: anonymity. The victim sees reflector addresses, not the attacker's. Tracing back requires cooperation from every reflector operator, which in practice does not happen.

This technique drove some of the largest DDoS events of the mid-2010s, including attacks measured around 400 Gbps, before widespread patching reduced the pool of usable reflectors.

Defending the Server — Do Not Be a Reflector

• Upgrade ntpd. Version 4.2.7p26 and later disable monlist by default. This is the single fix that mattered most.
• Disable the query interface explicitly if you cannot upgrade — noquery in the restrict directives, and disabling monitor.
• Restrict who can query the server at all, so it serves only your own networks.
• Rate-limit NTP responses at the server and at the edge.
• Implement BCP 38 / RFC 2827 ingress filtering. This is the real fix for the whole class of attack: network operators drop outbound packets whose source address does not belong to their network, which makes spoofing impossible at the source. It works only if everyone does it, which is why the problem persists.

Defending the Victim

• Upstream scrubbing or a DDoS mitigation service. Once your link is saturated, nothing you do on your own equipment helps — the congestion is upstream of you. This is the point candidates most often miss.
• Anycast and CDN distribution to spread the load across many locations.
• Block or rate-limit inbound UDP 123 at the provider edge if you do not need it externally.
• Sufficient bandwidth headroom, which buys time rather than solving anything.
• An incident response plan with your ISP agreed in advance. During an attack is a poor time to find the right phone number.

Related Amplification Vectors

NTP is one of a family, and exams may compare them. DNS amplification uses large zone or ANY responses, roughly 28–54:1. SSDP, SNMP, CLDAP, and Chargen all serve the same role. Memcached reflection, discovered in 2018, reached amplification factors above 50,000:1 and produced the largest attacks recorded at the time.

The common thread is always the same: a UDP service that returns more data than it receives and does not verify the requester. If you understand that sentence, you understand every attack in the family.

Security+ (SY0-701) Exam Tips

• Know the definition of reflection and amplification and that they are distinct ideas — reflection hides the source, amplification multiplies the volume. NTP does both.
• UDP and spoofing are the enablers. If a question asks why a protocol is usable for amplification, the answer involves connectionless UDP and unverified source addresses.
• monlist is the specific NTP command. Worth memorizing by name.
• NTP is UDP port 123.
• The victim's mitigation is upstream, not on their own firewall.
• Ingress filtering (BCP 38) is the structural fix for spoofing.
• Recognize the family: DNS, NTP, SSDP, SNMP, CLDAP, memcached.

Network+ and CySA+ Angles

Network+ (N10-009) covers NTP's normal role in time synchronization and why it matters, plus DDoS as a network attack type and the traffic patterns that indicate one.

CySA+ (CS0-004) approaches it as detection and response: recognizing a flood of inbound UDP 123 responses to hosts that never sent a query, reading flow data during a volumetric event, and coordinating with providers. It also expects you to identify your own servers appearing in someone else's attack.

Key Takeaways

• NTP amplification spoofs the victim's address in small requests to public time servers, which then flood the victim with large replies.
• The monlist command is the amplifier, turning an 8-byte request into up to 48 KB of response.
• Amplification factors reach several hundred to one, among the highest of any reflector.
• UDP's lack of a handshake is the root enabler, since the source address is never verified.
• Patch ntpd and disable monlist so your servers are not part of someone else's attack.
• Victims must mitigate upstream — a saturated link cannot be fixed at its own end.
• BCP 38 ingress filtering is the structural fix for the entire spoofing-based attack family.