I know once the traffic hits my server its too late, my servers cant be used for ddosing others as its responding very conservative to queries, I was specifically talking about the server responding with disconnect packets to NTP traffic, which I mitigated allowing NTP traffic only to 123 port for date sync. But thanks for input.