I examined my Network live log today and watched thousands of NTP dropped entries fly by;
09:48:36 Default DROP UDP 69.162.86.180:80 66.46.243.38:123
09:48:36 Default DROP UDP 198.245.51.115:80 66.46.243.38:123
09:48:36 Default DROP UDP 88.156.212.91:80 66.46.243.35:123
I examined my NTP server settings and had allowed "ANY" to access the NTP server.
A quick google search revealed that the new hotness is an NTP reflection and amplification attack using NTP servers that support MON_GETLIST "monlist"
Understanding and mitigating NTP-based DDoS attacks | CloudFlare Blog
I changed my NTP server settings to only support internal networks and the log events slowed and stopped.
Can anyone confirm that the UTM 9.106-17 and/or 9.108-23 has the potential to participate in NTP DDOS?
Thanks.
This thread was automatically locked due to age.
