<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:black;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">You can, in the short term, block NTP - all of it, in and out.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Clocks may drift, but no kittens will die.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Brad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> AusNOG [mailto:ausnog-bounces@lists.ausnog.net]
<b>On Behalf Of </b>James Braunegg<br>
<b>Sent:</b> Thursday, 13 February 2014 3:22 PM<br>
<b>To:</b> Sean K. Finn; ausnog@lists.ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] NTP Reflection coming in over Equinix IX<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Dear Sean<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">If you can filter on packet size you should find the attack request for the inbound NTP request is 50bytes in size, if you can drop this inbound request via pattern matching this will stop the request
attack traffic in its place from reaching anything downstream !<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">It also is important to understand if you are being targeted by a NTP attack or do you have hosts within your network precipitating in an attack.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">If you need any help just ask !<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Kindest Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-family:"Verdana","sans-serif";color:black">James Braunegg<br>
</span></b><b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black">P:</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black"> 1300 769 972 |
<b>M:</b> 0488 997 207 | <b>D:</b> (03) 9751 7616<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black">E:</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black">
</span><span lang="EN-US" style="color:black"><a href="mailto:james.braunegg@micron21.com"><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black">james.braunegg@micron21.com</span></a></span><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black">
| <b>ABN:</b> 12 109 977 666 <br>
<b>W:</b> <a href="http://www.micron21.com/ddos-protection"><span style="color:black">www.micron21.com/ddos-protection</span></a>
<b>T:</b> @micron21<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black"><br>
<img border="0" width="250" height="39" id="_x0000_i1025" src="cid:image001.jpg@01CF28D0.2E817B60" alt="Description: Description: Description: Description: M21.jpg"><br>
</span><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black">This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must
not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.</span><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> AusNOG [mailto:ausnog-bounces@lists.ausnog.net]
<b>On Behalf Of </b>Sean K. Finn<br>
<b>Sent:</b> Thursday, February 13, 2014 3:37 PM<br>
<b>To:</b> ausnog@lists.ausnog.net<br>
<b>Subject:</b> [AusNOG] NTP Reflection coming in over Equinix IX<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Hey All,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I never thought I’d see the day, we’re seeing local NTP Reflection attacks come in across Equinix peering!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thankfully they are very small amounts of traffic but you can see the traffic jump percentage wise.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><img border="0" width="596" height="210" id="Picture_x0020_1" src="cid:image002.png@01CF28D0.2E817B60"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Does anyone have any mitigation stategies across the Equinix IX . (Apart from obvious, i.e. contacting the peer AS’s to asking them to nice mitigate at their end and pray, or droping prefix from Equinix completely.)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">PS Anyone else on Equinix Syd if you’re smashing outbound on NTP please check
<span style="font-family:Wingdings">J</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is the first time we’ve seen reflection attack across peering!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What I once considered safe harbour has now been compromised.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kind Regards,<o:p></o:p></p>
<p class="MsoNormal">Sean Finn,<o:p></o:p></p>
<p class="MsoNormal">Oz Servers.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<hr size="1" width="100%" noshade="" style="color:#D0D3DD" align="center">
</span></div>
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:9.0pt;font-family:"Tahoma","sans-serif";color:silver">Premium Australian Hosting Solution Specialists</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<hr size="1" width="100%" noshade="" style="color:#D0D3DD" align="center">
</span></div>
<table class="MsoNormalTable" border="0" cellpadding="0" width="96%" style="width:96.9%">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Sean Finn,
</span></b><span style="font-size:7.0pt;font-family:"Tahoma","sans-serif"">BInfTech(NetSys)Qld.UT</span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Oz Servers</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><br>
e: <a href="mailto:sean.finn@ozservers.com.au"><span style="color:blue">sean.finn@ozservers.com.au</span></a><br>
<b>w: <a href="http://www.ozservers.com.au/" title="http://www.ozservers.com.au/">
<span style="color:blue">http://www.ozservers.com.au</span></a></b><br>
<b>p: 1300 13 89 69</b></span><span style="font-size:7.5pt;font-family:"Tahoma","sans-serif"">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Tahoma","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
</td>
<td style="padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" align="right" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:right">
<span style="font-size:12.0pt;font-family:"Times New Roman","serif""><img border="0" width="140" height="70" id="Picture_x005f_x005f_x005f_x0020_2" src="cid:image003.gif@01CF28D0.2E817B60" alt="ozlogo"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>