# NTP Amplification DDoS: When Time Servers Become Attack Infrastructure

> NTP's MONLIST command was designed for diagnostics. It became one of the most powerful DDoS amplifiers ever discovered — capable of 556x amplification.

- Category: Attack Analysis
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/ntp-amplification-ddos

---

Network Time Protocol quietly keeps the internet's clocks in sync, and for most of its life nobody thought of it as dangerous. Then attackers discovered its MONLIST command — a diagnostic feature that returns the last 600 addresses to query an NTP server. A tiny 234-byte request can trigger up to 48 KB of response: a 556x amplification ratio. Point that response at a victim by spoofing their address, multiply across thousands of open NTP servers, and a modest attacker generates a crushing flood.

## The Attack Pattern

- The attacker sends MONLIST requests to thousands of misconfigured NTP servers, spoofing the victim's IP as the source.
- Each server dutifully sends its large response to the victim, who never asked for it.
- The flood is hard to filter because it looks like legitimate NTP server traffic.
- This is not theoretical: Cloudflare mitigated a ~400 Gbps NTP amplification attack back in 2014.

## The Fix for NTP Server Operators

If you run an NTP server, you are part of the solution. Upgrade to NTP 4.2.7p26 or later, which disables MONLIST by default. If you cannot upgrade, add 'noquery' to the restrict lines in your ntp.conf. And if you are not running an NTP server on purpose, firewall UDP/123 off the public internet entirely — an unintended open NTP server is a weapon pointed at strangers.

> **Amplification is a shared-responsibility problem** — Every misconfigured NTP, DNS or Memcached server on the internet is ammunition for an attack on someone else. Locking down your own services is not just self-protection — it shrinks the arsenal available to attackers globally.

## Where a Reverse Proxy Fits — and Where It Doesn't

Be precise about scope. NTP amplification is a network-layer flood of UDP packets, so the flood itself must be stopped upstream — at your host or transit provider's network, ideally with BCP38 source-address validation. A reverse proxy like Akarguard does not scrub UDP and does not claim to. What it does contribute is origin privacy: because your web traffic resolves to the Akarguard edge, your real server IP stays hidden, so an amplified flood has no direct target and your origin never has to process it. For the raw volumetric packets, your network provider's capacity is what matters — not the proxy.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.