Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
On my server I see a lot of NTP requests. All NTP traffic is blocked by iptables. Is there anything more I could do to stop this traffic?
28M 1019M DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:123
The requests are coming from all different ip addresses. Is this some sort of DDOS attack?
If you have a dynamic IP address (or have recently acquired a static one), it could be that your address was previously used by the global public NTP pool. You could check https://www.pool.ntp.org/scores/IPADDRESS (substitute IPADDRESS for your public IP address - it supports both IPv4 and IPv6) to see if your address has been used previously in the pool.
Keep in mind that normal NTP packets are very small, so depending on the timeframe over which those 28M packets occurred over, it might work out to a relatively small level of background traffic. When did you last reset your iptables counters? It may not be worth worrying about.
Alternatively, as Tero Kilkanen pointed out, it could be a DDoS. Attempted reflection attacks using vulnerable NTP servers are still relatively common, so it's not particularly unexpected, especially if you're on a dynamic or recently-acquired static address, or running a gaming server.
If you want to know if it's a reflection attack, grab a packet capture of all NTP traffic over a fixed period, then look at the packets in Wireshark and find out how many have a UDP payload over 72 bytes in length. A normal NTP packet is 56 bytes of UDP payload, and with a Message Authentication Code this goes up to 72. (Use a Wireshark display filter of udp.length > 72 to see this.) If there is a significant percentage of larger packets, it's probably a DDoS and you might want to involve your ISP.
