Network Time Protocol quietly keeps the internet's clocks in sync, and for most of its life nobody thought of it as dangerous. Then attackers discovered its MONLIST command — a diagnostic feature that returns the last 600 addresses to query an NTP server. A tiny 234-byte request can trigger up to 48 KB of response: a 556x amplification ratio. Point that response at a victim by spoofing their address, multiply across thousands of open NTP servers, and a modest attacker generates a crushing flood.
The Attack Pattern
- The attacker sends MONLIST requests to thousands of misconfigured NTP servers, spoofing the victim's IP as the source.
- Each server dutifully sends its large response to the victim, who never asked for it.
- The flood is hard to filter because it looks like legitimate NTP server traffic.
- This is not theoretical: Cloudflare mitigated a ~400 Gbps NTP amplification attack back in 2014.
The Fix for NTP Server Operators
If you run an NTP server, you are part of the solution. Upgrade to NTP 4.2.7p26 or later, which disables MONLIST by default. If you cannot upgrade, add 'noquery' to the restrict lines in your ntp.conf. And if you are not running an NTP server on purpose, firewall UDP/123 off the public internet entirely — an unintended open NTP server is a weapon pointed at strangers.
Amplification is a shared-responsibility problem
Every misconfigured NTP, DNS or Memcached server on the internet is ammunition for an attack on someone else. Locking down your own services is not just self-protection — it shrinks the arsenal available to attackers globally.
Where a Reverse Proxy Fits — and Where It Doesn't
Be precise about scope. NTP amplification is a network-layer flood of UDP packets, so the flood itself must be stopped upstream — at your host or transit provider's network, ideally with BCP38 source-address validation. A reverse proxy like Akarguard does not scrub UDP and does not claim to. What it does contribute is origin privacy: because your web traffic resolves to the Akarguard edge, your real server IP stays hidden, so an amplified flood has no direct target and your origin never has to process it. For the raw volumetric packets, your network provider's capacity is what matters — not the proxy.