An NTP amplification attack is a Layer 4 reflection attack vector producing volumetric Layer 3 saturation, one of the classes a thorough DDoS test is built to exercise. Like every member of the reflection attack family it spoofs the victim's IP so a set of innocent third-party servers answer the victim instead of the attacker. What makes NTP its own vector is the specific command it abuses and the size of the reply that command produces.
What makes NTP amplification specific
The abused feature is monlist, an old monitoring command (mode 7) in the reference ntpd. A single small query asks a Network Time Protocol server for its recent traffic, and the server answers with a list of the last addresses that contacted it, up to 600 hosts, split across many packets. The request is a handful of bytes; the reply can be hundreds of times larger.
That ratio is the headline. US-CERT's advisory TA14-013A puts NTP monlist at an amplification factor of about 556, meaning a byte sent by the attacker becomes roughly 556 bytes aimed at the victim, one of the highest factors of any UDP reflection vector. The traffic rides UDP port 123, the standard NTP port, which is widely allowed through firewalls because time sync is essential, so the reflected flood arrives on a port most networks are reluctant to block outright.
The vector had a defining moment. In February 2014 Cloudflare documented an NTP reflection flood that peaked near 400 Gbps, generated from roughly 4,500 vulnerable NTP servers, briefly the largest volumetric attack publicly recorded at the time. It made NTP the textbook example of how a single misconfigured legacy service, deployed on tens of thousands of hosts, becomes internet-scale attack capacity.
Why it matters under attack
The structural point is that the victim never touches an attacker. The flood comes from thousands of legitimate time servers, each sending what looks like a normal, if large, NTP response, so there is no malicious source to block and no payload signature to filter. Defense is about absorbing and scrubbing volume upstream, not identifying a sender.
monlist was disabled by default in ntpd 4.2.7p26, and years of operator cleanup have shrunk the pool of abusable servers, but unpatched and forgotten hosts keep the vector alive. Any UDP reflector that survives on the internet stays useful to an attacker for as long as it answers.
What a DDoS test measures
Because prevention lives at the carrier edge and on other people's servers, a test does not try to stop NTP reflection at the origin. It characterizes absorption: how much reflected volume the upstream scrubbing and edge capacity swallow before the origin link saturates, and how fast mitigation engages once the flood starts.
It also confirms the boundary conditions that matter for this vector specifically. Is UDP port 123 traffic that the service does not actually need being dropped or rate-limited at the edge, and does the amplification factor assumed in capacity planning match what a real reflector set can deliver? The permanent fix is source-address validation, BCP 38, at the networks where the spoofed packets originate, which is why every reflection vector, NTP included, is tested for absorption rather than prevention. The wider reflection family is covered in Understanding DDoS Attack Vectors.