Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore mitigate the attack?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

I expect any decent DDoS protection service (Prolexic, CloudFlare, etc.) will do exactly what you suggest.

If you consider a basic web presence, where the site has limit bandwidth to the Internet, an on-site blacklist doesn't help. All that NTP traffic will saturate the link, so it doesn't matter that the on-site firewall immediately drops the traffic - it still interferes with legitimate users. This is why you need upstream filtering to mitigate a DDoS attack.

share|improve this answer
    
right, but why limit it to DDos Protection services and not just arbitrary backbone nodes on the net? –  chacham15 Feb 23 at 8:04
    
@chacham15 - there is no such thing as a global blacklist. Perhaps there should be one, but as of 2014 no-one has worked out a way to do it. –  paj28 Feb 23 at 8:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.