2

On my server I see a lot of NTP requests. All NTP traffic is blocked by iptables. Is there anything more I could do to stop this traffic?

28M 1019M DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:123

The requests are coming from all different ip addresses. Is this some sort of DDOS attack?

  • How long has this particular rule been active? If it has been active for more then couple of days, then it is definitely a DDoS attack. Just normal internet background noise. In theory, you could ask your service provider to block this traffic on their firewall. In practice, there is no point to ask for that. – Tero Kilkanen Sep 21 '20 at 6:31
2

If you have a dynamic IP address (or have recently acquired a static one), it could be that your address was previously used by the global public NTP pool. You could check https://www.pool.ntp.org/scores/IPADDRESS (substitute IPADDRESS for your public IP address - it supports both IPv4 and IPv6) to see if your address has been used previously in the pool.

Keep in mind that normal NTP packets are very small, so depending on the timeframe over which those 28M packets occurred over, it might work out to a relatively small level of background traffic. When did you last reset your iptables counters? It may not be worth worrying about.

Alternatively, as Tero Kilkanen pointed out, it could be a DDoS. Attempted reflection attacks using vulnerable NTP servers are still relatively common, so it's not particularly unexpected, especially if you're on a dynamic or recently-acquired static address, or running a gaming server.

If you want to know if it's a reflection attack, grab a packet capture of all NTP traffic over a fixed period, then look at the packets in Wireshark and find out how many have a UDP payload over 72 bytes in length. A normal NTP packet is 56 bytes of UDP payload, and with a Message Authentication Code this goes up to 72. (Use a Wireshark display filter of udp.length > 72 to see this.) If there is a significant percentage of larger packets, it's probably a DDoS and you might want to involve your ISP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.