Re: [Ntp] [tsvwg] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Eliot Lear <[e-mail]>]

Just to follow this up, my point is that the version bit doesn't matter 
if the packets aren't getting to endpoints.  At that point we need to 
start thinking about what is best for the Internet, and there may well 
be a tradeoff here.  But it really depends on what the operational data 
looks like, in so much as we can get at it.

Eliot

On 07.12.21 20:43, Eliot Lear wrote:
>
> We have the following situation, as I understand it:
>
> There remain servers out there that are open to control packets, and 
> those packets are amplified at target NTP servers. Deployments have 
> mitigated the attack by placing a firewall rule that matches the frame 
> size of a normal NTP query, rather than enumerating the NTP servers 
> that they permit.  Do I have the situation correct?
>
> So we have a combination of a protocol weakness, open NTP servers, and 
> a common firewall rule set that won't let the right thing happen.  
> Does anyone know how common?
>
> Eliot
>
>
>
> On 07.12.21 17:31, [e-mail] wrote:
>>
>> —
>> Joe Touch, temporal epistemologist
>> www.strayalpha.com <http://www.strayalpha.com>
>>
>>> On Dec 7, 2021, at 2:21 AM, Miroslav Lichvar <[e-mail]> 
>>> wrote:
>>>
>>> On Tue, Dec 07, 2021 at 10:23:10AM +0100, Martin Burnicki wrote:
>>>> I find it ridiculous to start using a new port for NTP because some 
>>>> admins
>>>> block the original, well-known port because many years ago there was a
>>>> possibility for DDoS for servers that weren't properly configured.
>>>
>>> That possibility still exists. It's a security issue in the protocol.
>>
>> Again, IMO, that’s why protocols (including NTP) have version numbers.
>>
>> I look forward to a new NTP version that addresses these issues, but 
>> it should run on the existing port.
>>
>> This is the *same* issue every protocol encounters for any vulnerability.
>>
>> Joe
>>