NTP amplification
DDoS variant that abuses old NTP servers with the monlist command enabled. Attacker sends a 234-byte query with spoofed source = victim; server replies with a 48 KB list of the last 600 clients. Amp factor 200x.
2014: 400 Gbps attack against Cloudflare via NTP — at the time the biggest DDoS in history. Patch: NTP 4.2.7p26+ (2010) removed monlist. Operators who didn't update were ammunition for years. The Open NTP Project mapped thousands of vulnerable servers publicly. Modern NTP deployment uses pool.ntp.org (well-run) or server versions without monlist. NTPsec (security fork of NTP) removed the whole mode-7 stack. Symptom as victim: 100% bandwidth consumed by UDP 123 responses you never asked for.