We're dealing with an NTP reflection / amplification attack at our colocated servers. This question is specific to responding to NTP reflection attacks, and not directed at DDoS in general.
Here's the traffic:
It's churning a bit of CPU on our router:
Unfortunately it is not big enough to cause our upstream provider to blackhole the traffic, which means it's passing through to us.
We've used the following rule to block the NTP traffic, which originates on port 123:
-p udp --sport 123 -j DROP
This is the first rule in IPTables.
I searched a lot, and I can't find very much information on how to use IPTables to mitigate a NTP reflection attack. And some of the information out there seems flat out incorrect. Is this IPTables rule correct? Is there anything else we can add, or do, to mitigate a NTP reflection / amplification attack other than contact our upstream network provider?
Also: since these attackers must be using networks that
- allow spoofing of IP address in packets
- have unpatched, circa 2010 NTP code
is there any global clearinghouse we can report these IP addresses to, so that they get fixed to stop allowing spoofed packets, and patch their NTP servers?