[AusNOG] NTP Reflection coming in over Equinix IX

[Dobbins, Roland]

On Feb 14, 2014, at 7:04 AM, James Braunegg <james.braunegg at micron21.com> wrote:

> Have a read here for more information - http://www.micron21.com/ddos-ntp  would value your input on the wire shark capture which is "wild" attack traffic.

I'd need to see the pcap - I'm sitting here looking at multiple pcaps of 90 bytes.

Is it possible that the 'Length' field in the screenshot isn't overall packet length, but payload only?  My Wireshark doesn't have a 'Length' column, but rather a 'size' column . . .

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton