How NTP UDP Reflection Attacks Work

Network Time Protocol (NTP) reflection attacks are a dangerous form of Distributed Denial of Service (DDoS) that leverage publicly accessible NTP servers to overwhelm a target with amplified network traffic. By abusing the connectionless nature of the User Datagram Protocol (UDP) and specific NTP query commands, attackers can reflect large amounts of data toward a victim while hiding their true origin. This article explains the technical mechanics of how NTP is exploited, the amplification effect, and common mitigation strategies.

The Role of UDP and IP Spoofing

The foundation of an NTP reflection attack relies on the User Datagram Protocol (UDP). Unlike TCP, UDP does not require a three-way handshake to establish a connection. Because no verification occurs between the sender and the receiver, the source IP address in the packet header can be forged (spoofed) with ease. An attacker crafts a request to an NTP server and replaces their own IP address with the victim’s IP address. When the NTP server processes the request, it transmits the response directly to the victim instead of the actual sender.

The monlist Command and Amplification

While simple IP spoofing enables traffic reflection, the true danger comes from amplification. In older and misconfigured versions of NTP, an administrative command called monlist is enabled by default.

The monlist command queries the NTP server to return the IP addresses of the last 600 hosts that have communicated with it. Because this historical data cannot fit into a single small packet, the server splits the list across multiple large UDP packets.

  1. Small Request: The attacker sends a small monlist query (typically around 234 bytes) with the victim’s spoofed source IP.
  2. Massive Response: The NTP server generates multiple responses containing up to 600 addresses, generating several kilobytes of data (often over 48,000 bytes).

This dynamic creates an amplification factor of up to 200x to 500x. If an attacker controls a botnet sending thousands of these spoofed requests per second to multiple vulnerable NTP servers simultaneously, the resulting traffic reflected onto the victim can easily reach tens or hundreds of gigabits per second, causing severe network outages.

Mitigation and Defense

Securing networks against NTP amplification requires actions from both network administrators and service providers: