NTP Amplification Check
A misconfigured NTP server is one of the most powerful DDoS amplification sources on the internet: a tiny spoofed request can trigger a response hundreds of times larger. Enter a host or IP and this check sends one safe query each of mode 3, mode 6 and mode 7 to UDP/123 to find out whether the server answers the dangerous monlist (mode-7) query or unauthenticated mode-6 control queries, measures the amplification factor, and returns the exact fix. It is read-only — one query per mode, never a flood.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- monlist — whether the server answers the mode-7 monlist query (CVE-2013-5211), a high-impact DDoS amplification source that also leaks recent client IP addresses (SVC_NTP_MONLIST)
- mode-6 control — whether it answers unauthenticated mode-6 (ntpq readvar) queries, usable for reflection and for leaking daemon/OS build details (SVC_NTP_MODE6)
- The amplification factor — response bytes divided by request bytes — the lever an attacker exploits
- Whether a real NTP server replies to a plain time (mode-3) query at all, with its banner/refid
- The detected NTP product/build where disclosed
- The equivalent commands — ntpdc -n -c monlist <host>, or nmap -sU -p123 --script ntp-monlist <host>
How to read the result
- OK — no NTP: nothing replied on UDP/123, so the host can't be abused as an NTP reflection source from here.
- Fail — monlist answered: the server replies to the mode-7 monlist query (CVE-2013-5211); it's a high-impact amplifier and leaks recent client IPs. Disable monlist or upgrade ntpd now. The summary shows the measured amplification (e.g. ~30x).
- Warn — mode-6 exposed: the server answers unauthenticated mode-6 (ntpq readvar) control queries, usable for reflection and leaking daemon/OS build details; restrict remote control queries.
- Amplification of ~10x or more is flagged as a failure-grade row because that ratio makes the server a serious reflection weapon.
- OK — time only: the server answers ordinary time queries but refuses mode-6/7, so it isn't usable as a reflection/amplification source from the public internet.
- The amplification row shows the response/request byte ratio directly so you can gauge how attractive the server is as a reflector.
Frequently asked questions
What is the NTP monlist vulnerability (CVE-2013-5211)?
monlist is an old ntpd 'mode 7' debug command that returns a list of the last hosts that talked to the server. The reply can be hundreds of times larger than the request, so an attacker spoofs a victim's IP and uses the server to flood it — a massive amplification DDoS. It also leaks the IPs of recent NTP clients. The fix is to disable monlist or run a current ntpd.
How do I disable monlist / fix NTP amplification?
Upgrade to ntpd 4.2.7p26 or later (where monlist is removed), or on older versions add 'disable monitor' to ntp.conf, plus 'restrict default ... noquery' to refuse status/control queries from outside. Alternatively switch to a daemon like chrony. After the change, re-run this check — monlist and mode-6 should no longer answer.
What is a mode-6 query and why does it matter?
Mode 6 is ntpd's control protocol (used by ntpq, e.g. readvar). If the server answers mode-6 queries from anyone, it can be used as another reflection vector and it discloses daemon and OS build details that help an attacker fingerprint the host. Restricting remote control queries ('noquery') closes it.
What does the amplification factor tell me?
It's the size of the server's response divided by the size of the request. The bigger it is, the more bandwidth an attacker can generate from a small spoofed packet — which is exactly what makes NTP attractive for reflection DDoS. A healthy, locked-down time server answers normal time queries without large amplifying responses.
Will this check flood or harm my NTP server?
No. It sends a single safe query for each mode (one mode-3 time query, one mode-6 control query, one mode-7 monlist query) and reads the replies. It does not send repeated traffic or attempt a real amplification attack — it just measures whether the dangerous responses are possible.
My server answers time but not monlist — is that fine?
Yes, that's the healthy result. Serving accurate time on UDP/123 is the point of NTP; the danger is only in the monlist (mode-7) and unauthenticated mode-6 control responses. If those are refused, the server isn't usable as a reflection/amplification source from the public internet.