I'm a security research studying CLDAP as a vector for UDP reflection attacks, a from of Denial of Service. I'm not a MS Server expert, so I want to sure up my understanding of the context of the CLDAP service.
The CLDAP service is a UDP version of the LDAP service exposed on MS Servers' that implement Active Directory. From the MS literature, there is only one command implemented over CLDAP (the UDP version of LDAP), and that is the LDAP Ping. This command then is leveraged as a reflective vector by malicious actors conducting denial of service attacks.
The intended purpose of the LDAP Ping is the discovery of information about collaborating Domain Controllers. The docs say the purpose is "to verify the aliveness of the domain controller and also check whether the domain controller matches a specific set of requirements." This scope of usage on this sounds to be intended only as a MS Server inter-server cooperative thing.
The "open CLDAP reflectors" that I track all have this service exposed directly to the open internet. I assume much of this is due to accident, gross naivete, or some other non-standard usage.
But maybe I'm wrong. Is there any standard, valid practice of MS Server deployment and configuration that would have these Domain Controllers trying to discover each other over the open internet? Or can I say that they are all, more or less, accidentally exposed?