NTP Reflection Amplification DDoS Attack

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•7

This rule detects NTP Reflection Amplification DDoS attacks by looking for specific content in UDP packets destined for the home network on port 123 (NTP). The rule triggers if 50 such packets are observed from the same destination within 5 seconds, indicating a high volume of NTP traffic potentially used for amplification.