[Pool] flood from 75.76.155.206

lst_hoe02 at 79365-rhs.de lst_hoe02 at 79365-rhs.de
Wed May 8 15:24:11 UTC 2013


Zitat von ntppool at arpage.org:

> For the last six hours or so I have seen an obnoxious rate of  
> requests (ranging from 60 to 300 per second) from the aforementioned  
> IP.  Not sure if it's a badly implemented client or someone trying  
> to use my server for some sort of reflective attack.  It has long  
> since been blocked by my firewall but I've been running servers in  
> the pool for a few years now and never had to deal with this before.
>
> Curious if anybody else has seen this?  Any suggestions for what to  
> do about it other than block the traffic at my edge and wait for it  
> to die down?

It was about 2 years ago when my server was new to the pool i have  
seen around 500-1000 packets per second from a single IP. As this  
server was not the most powerfull i decided to simply drop all packets  
from the offending IP. It took around 16M (dropped) packets (~1,2GByte  
traffic) until it stopped. I hope you have a generous traffic limit,  
than you can simply wait until its over because ntp does not care that  
much.

Regards

Andreas




More information about the pool mailing list