Intrusion PreventionNTP.Unknown.Stratum
Description
This signature indicates a NTP protocol anomaly. It indicates detection of a Network Time Protocol (NTP) packet with an unknown stratum field.
The Stratum field of NTP protocol is 8-bit integer and currently values above 16 are not defined according to RFC document. Any values above 16 will trigger this signature.
Affected Products
Any host running NTP service
Impact
This is an anomaly, which may suggest attack attempts.
Recommended Actions
This indicates detection of traffic that does not comply with the protocol standard. Monitor the traffic from that network for any suspicious activity.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 37576 |
| Created | Dec 23, 2013 |
| Updated | Jul 14, 2014 |
| Risk |
|
| Default Action | pass |
| Active | |
| Affected OS | All |
| Affected App | Other |