According to Arbor, the peak NTP storm was during the spring of 2014, but it's noticeable that average NTP traffic then fell back to what are still historically high levels around the 120Gbps mark. For comparison, the background level in 2008 was 1Gbps, which should have risen a bit as more equipment was lit up since then. But it's now trending way above that level all the time and Arbor Networks' UK director of solutions architects, Darren Anstee told Techworld that many ISPs now rate-limit the protocol as a way of coping.
The bad news is that the Internet is choc with other protocols, many of which can be used as fuel to throw on to the DDoS bonfire, including SSDP (a growing problem), Chargen, DVMRP SNMP, as well as the pioneer, DNS. Any one of these was detected in attacks approaching or exceeding 100Gbps during 2014.
Sign up for MIS Asia eNewsletters.