Noticing latency issues at its connection to the Internet, a company suspects that it is being targeted in a Distributed Denial of Service attack. A security analyst discovers numerous inbound…

Blocking all inbound connections to NTP servers would prevent clients from synchronizing time, causing authentication failures, certificate validation errors, and broad operational disruption across the network.

Blocking individual source IPs is ineffective against a distributed attack involving thousands of spoofed or botnet source addresses, and does not address the underlying monlist vulnerability that enables the amplification.

Disabling the NTP servers entirely would break time synchronization for all systems on the network, causing significant operational impact including Kerberos authentication failures and log integrity issues.

The NTP monlist command responds with up to 600 recent client entries, creating a large amplification factor that attackers exploit by spoofing victim IP addresses to flood them with traffic. Disabling monlist via 'noquery' or 'disable monitor' in the NTP configuration surgically removes this specific vulnerable command without affecting the core time synchronization function. This is the least-impact option because all legitimate NTP operations continue uninterrupted for clients across the organization.