Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore mitigate the attack?

share|improve this question
up vote 3 down vote accepted

I expect any decent DDoS protection service (Prolexic, CloudFlare, etc.) will do exactly what you suggest.

If you consider a basic web presence, where the site has limit bandwidth to the Internet, an on-site blacklist doesn't help. All that NTP traffic will saturate the link, so it doesn't matter that the on-site firewall immediately drops the traffic - it still interferes with legitimate users. This is why you need upstream filtering to mitigate a DDoS attack.

share|improve this answer
right, but why limit it to DDos Protection services and not just arbitrary backbone nodes on the net? – chacham15 Feb 23 '14 at 8:04
@chacham15 - there is no such thing as a global blacklist. Perhaps there should be one, but as of 2014 no-one has worked out a way to do it. – paj28 Feb 23 '14 at 8:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.