[ntp:questions] NTP Denial of Service attack 29 November 2011

Doug Calvert dfc-list at douglasfcalvert.net
Tue Nov 29 23:51:14 UTC 2011


On 11/29/2011 03:44 PM, Rich wrote:
> USNO is seeing an apparent coordinated denial of service attack on NTP
> originating with the following IPs:
> 220.117.53.67; 218.92.115.152; 114.40.28.224; 218.201.21.194.   I
> recommend that you block 220.0.0.0/8, 218.0.0.0/8, and 114.0.0.0/8.
> There will likely be more to follow. These appear to originate on
> APNIC (Asian Pacific).
> 
> Currently we are seeing many tens of thousands of packets per second
> coming in.
> 

Pictures make every story better...

http://tycho.usno.navy.mil/ntpplot.html


More information about the questions mailing list