<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText>Dear All<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>For those interested I updated my DDoS NTP attack info page with additional information regarding NTP attack packet sizes as per Roland’s information and also included an NTP DDoS attack graph showing mitigation via edge packet filtering.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Updates can be found here - <a href="http://www.micron21.com/ddos-ntp/">http://www.micron21.com/ddos-ntp/</a> <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Kindest Regards<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span style='font-family:"Verdana","sans-serif";color:black'>James Braunegg<br></span></b><b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>P:</span></b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> 1300 769 972 | <b>M:</b> 0488 997 207 | <b>D:</b> (03) 9751 7616</span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>E:</span></b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> </span><span style='color:black'><a href="mailto:james.braunegg@micron21.com"><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>james.braunegg@micron21.com</span></a></span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> | <b>ABN:</b> 12 109 977 666 <br><b>W:</b> <a href="http://www.micron21.com/ddos-protection"><span style='color:black'>www.micron21.com/ddos-protection</span></a> <b>T:</b> @micron21<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><br><img border=0 width=250 height=39 id="Picture_x0020_1" src="cid:image001.jpg@01CF2C05.58330130" alt="Description: Description: Description: Description: M21.jpg"><br></span><span lang=EN-AU style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.</span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----Original Message-----<br>From: AusNOG [mailto:ausnog-bounces@lists.ausnog.net] On Behalf Of Dobbins, Roland<br>Sent: Monday, February 17, 2014 3:15 PM<br>To: ausnog@lists.ausnog.net<br>Subject: Re: [AusNOG] NTP Reflection coming in over Equinix IX</p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>On Feb 14, 2014, at 7:43 AM, James Braunegg <<a href="mailto:james.braunegg@micron21.com"><span style='color:windowtext;text-decoration:none'>james.braunegg@micron21.com</span></a>> wrote:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>> I'll email you the pcap file for an off line discussion would be interesting to see if different version of wire shark show different data...<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>James and I've already corresponded, here's what's apparently going on - the ntp RFCs state that ntp packets should be padded with 0s in order to fit a 64-bit boundary, and different attack tools/mechanisms perform differing amounts of padding.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Here's a breakdown in terms of observed monlist packet sizes:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>ntp attack tool used in this most recent spate of attacks - 50 bytes, per James' weblog post.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>ntpdos.py - 60 bytes<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>ntp_monlist.py = 234 bytes<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>monlist, sysstat, et. al. from ntpdc/ntpq - 234 bytes<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>So, the monlist packet-size varies based upon the amount of padding implemented by each tool author.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>The one constant I've found is that regular ntp time-sync requests are ~90 bytes in size. So, blocking traffic at the relevant edges destined for UDP/123 with a size of 50 byes, 60 bytes, and 234 bytes appears to be a non-destructive way of dropping level-6/-7 admin commands whilst still allowing time-sync to function. Be sure and pilot this prior to general deployment, though.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----------------------------------------------------------------------<o:p></o:p></p><p class=MsoPlainText>Roland Dobbins <<a href="mailto:rdobbins@arbor.net"><span style='color:windowtext;text-decoration:none'>rdobbins@arbor.net</span></a>> // <<a href="http://www.arbornetworks.com"><span style='color:windowtext;text-decoration:none'>http://www.arbornetworks.com</span></a>><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> Luck is the residue of opportunity and design.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> -- John Milton<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>_______________________________________________<o:p></o:p></p><p class=MsoPlainText>AusNOG mailing list<o:p></o:p></p><p class=MsoPlainText><a href="mailto:AusNOG@lists.ausnog.net"><span style='color:windowtext;text-decoration:none'>AusNOG@lists.ausnog.net</span></a><o:p></o:p></p><p class=MsoPlainText><a href="http://lists.ausnog.net/mailman/listinfo/ausnog"><span style='color:windowtext;text-decoration:none'>http://lists.ausnog.net/mailman/listinfo/ausnog</span></a><o:p></o:p></p></div></body></html>