# Howto deal with bad NTP-Client / Attacker?

**URL:** <https://community.ntppool.org/t/howto-deal-with-bad-ntp-client-attacker/3101>\
**Category:** Server operators\
**Created:** [October 31, 2023, 2:43pm UTC](https://community.ntppool.org/t/howto-deal-with-bad-ntp-client-attacker/3101 "2023-10-31T14:43:09Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![erayd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/erayd/32/85_2.png) [@erayd](https://community.ntppool.org/u/erayd)\
**Post date:** [November 1, 2023, 12:49am UTC](https://community.ntppool.org/t/howto-deal-with-bad-ntp-client-attacker/3101/5 "2023-11-01T00:49:13Z")

</div>

> [@mkrsn](#):
>
> ~75req/s one of my NTP Server

How long does it do that for?

If it’s brief, I wouldn’t worry about it.

I have an automated ruleset on my edge firewall that deals with the larger offenders:

> [@Realistic max packets/sec per source IP?](https://community.ntppool.org/t/realistic-max-packets-sec-per-source-ip/1648/20):
>
> Sure. I use the following (on Mikrotik RouterOS). Anything that exceeds 1000 packets / sec and a 3000 packet burst gets logged and put in the throttling list for the next 24 hours. Anything in the throttling list gets limited to max 1000 packets / sec with a burst of 250 packets; excess traffic gets dropped. All limits are per-source-IP. /ip firewall raw add action=jump chain=prerouting dst-port=123 jump-target=high-rate-ntp/throttle protocol=udp src-address-list=high-rate-ntp/throttle add acti…

---

_[View the full topic](https://community.ntppool.org/t/howto-deal-with-bad-ntp-client-attacker/3101)._