>>990 We have closed port 123 at the core routers. Probably the outage today was caused by NT amplification. There is one ore more misconfigured NTP server causing this. http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack Closing port 123 will probably cause other problems later, but it should be good enough until the NTP server/servers that are running can be located, and either turned off or reconfigured.