Since mid-May 2003, the University of Wisconsin-Madison has experienced a sustained flood of network traffic targeting its public Network Time Protocol (NTP) server. The traffic, originating primarily from Netgear routers worldwide, consists of Simple Network Time Protocol (SNTP) queries sent at unusually high rates. Initial investigations revealed that these queries all used the same fixed source port number, allowing the university to selectively block the problematic traffic. However, the flood persisted and even increased over the following month, reaching over 250,000 packets per second and consuming more than 150 megabits per second of bandwidth.
Further analysis showed that the source IP addresses were legitimate and corresponded to real devices running a flawed SNTP client embedded in certain Netgear router models, including the MR814 and RP614. This client was found to be hard-coded to query the university's time server IP address (128.105.39.11) and to poll at an excessive frequency—up to once per second—far beyond typical best practices for NTP clients.
The university contacted Netgear with detailed findings, including evidence from firmware code analysis that confirmed the presence of the hard-coded IP address and fixed source port number. Despite initial delays in response from Netgear's support, the company eventually engaged in a collaborative review process with university and network experts.
Netgear acknowledged the issue and has been developing firmware updates to correct the SNTP client behavior. Updated firmware versions for affected models no longer rely on the University of Wisconsin's time server and reduce polling frequency. However, given the large number of deployed devices—over 700,000 affected units estimated—the university and Netgear agree that relying on customers to upgrade firmware is not a practical solution.
To mitigate the ongoing impact, the university is exploring network-level solutions such as deploying redundant, geographically distributed NTP servers using Border Gateway Protocol (BGP) anycast routing within its regional network. This approach aims to distribute the load and improve resilience without consuming excessive IP address space. Another option under consideration involves suppressing the problematic traffic by withdrawing certain IP address blocks from global routing, though this carries risks of collateral network reachability issues.
The incident highlights the challenges posed by embedded device software flaws that can inadvertently generate large-scale denial-of-service conditions. It underscores the importance of adhering to Internet protocol best practices, such as avoiding hard-coded server addresses and excessive polling intervals in client implementations.
The University of Wisconsin-Madison continues to provide service to the affected Netgear devices while working with the manufacturer and the broader Internet community to develop long-term solutions. This case also prompted efforts to improve documentation and standards related to SNTP client behavior to prevent similar issues in the future.