[ntp:hackers] query spikes seen in ntp traffic at ren-isac

Poul-Henning Kamp phk at phk.freebsd.dk
Thu Mar 23 21:29:05 UTC 2006

In message <20060323204141.54A7411426 at sa.vix.com>, Paul Vixie writes:
>thanks to donald smith of qwest for this:
>	http://www.ren-isac.net/monitoring/port-costa.cgi?udp_dst_123_packets
>i believe this means the bad guys know that ntp currently makes a good
>reflector, and it's only a matter of time before it's in the headlines.

That is not a given, It might just be badly written clients which
do excessive burstmode :-(

Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

More information about the hackers mailing list