Intrusion Prevention

NTP.Unknown.Stratum

Description

This signature indicates a NTP protocol anomaly. It indicates detection of a Network Time Protocol (NTP) packet with an unknown stratum field.
The Stratum field of NTP protocol is 8-bit integer and currently values above 16 are not defined according to RFC document. Any values above 16 will trigger this signature.

Affected Products

Any host running NTP service

Impact

This is an anomaly, which may suggest attack attempts.

Recommended Actions

This indicates detection of traffic that does not comply with the protocol standard. Monitor the traffic from that network for any suspicious activity.