[AusNOG] NTP reflection used for world's largest DDoS

[Scott Weeks]

--- daniel at glovine.com.au wrote:
From: Daniel Watson <daniel at glovine.com.au>

http://www.itnews.com.au/News/372033,worlds-largest-ddos-strikes-us-europe.aspx
---------------------------------------

It's well past beer o'clock here, so my math or logic may not be
optimally functioning...  ;-)

"For example, 100Mbps of spoofed NTP traffic can cause 5.8Gbps of
malicious traffic to strike the spoofed target," the report read."

"CloudFlare chief executive Matthew Prince said the attack tipped 
400Gbps"

400G / 5.8G = 69

69 * 100Mbps = 6.9Gbps

So someone is using 6.9Gbps of bandwidth just for an NTP attack?

Or are the spoofed packets coming from bots and that bandwidth is
spread across a lot of different pipes?

Or do I need another beer?  :-)

scott





_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog