Howto deal with bad NTP-Client / Attacker?

[erayd]

@mkrsn

~75req/s one of my NTP Server

How long does it do that for?

If it’s brief, I wouldn’t worry about it.

I have an automated ruleset on my edge firewall that deals with the larger offenders:

Realistic max packets/sec per source IP?

Sure. I use the following (on Mikrotik RouterOS). Anything that exceeds 1000 packets / sec and a 3000 packet burst gets logged and put in the throttling list for the next 24 hours. Anything in the throttling list gets limited to max 1000 packets / sec with a burst of 250 packets; excess traffic gets dropped. All limits are per-source-IP. /ip firewall raw add action=jump chain=prerouting dst-port=123 jump-target=high-rate-ntp/throttle protocol=udp src-address-list=high-rate-ntp/throttle add acti…