NTP Amplification DDoS Attack Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.