What is NTP amplification?
It's a reflection DDoS attack that abuses NTP (Network Time Protocol), used to sync clocks. The attacker sends the monlist command (or similar) to NTP servers with the victim's spoofed IP; the server replies with a huge list of recent connections, producing a response up to ~200 times larger than the request, aimed at the victim.
How does the amplification work?
With such a high amplification factor, a low-bandwidth attacker generates a massive volumetric attack. It's enough to find misconfigured NTP servers that answer monlist from the internet and use them as reflectors and traffic multipliers.
How to mitigate it?
Update NTP servers and disable the monlist command (modern versions already do), restrict queries to trusted networks, filter source spoofing (BCP38), and deploy edge anti-DDoS mitigation to absorb the reflected traffic.
