Re: [Ntp] Antw: Re: I-D Action: draft-ietf-ntp-port-randomization-00.txt

[Miroslav Lichvar <[e-mail]>]

On Wed, Nov 13, 2019 at 12:49:32PM +0100, Ulrich Windl wrote:
> >>> Miroslav Lichvar <[e-mail]> schrieb am 13.11.2019 um 12:21 in
> > ‑ It seems to be the current practice. From the implementations
> >   that I'm familiar with and that use a random source port, each one
> >   opens a new socket for each request, at least by default. On my
> >   public servers I see that most clients do change their port over
> >   time.
> 
> >From remote you cannot know whether it's the same instance of the same client
> sending the requests.

Yes, there could be multiple clients (e.g. behind NAT), but I think we
can make a good guess whether any of them use a stable port by
counting how many requests are there per port. When I analyze 24-hour
captures from public servers in few different countries, for most
addresses there seem to be only one request per port. I'm ignoring
addresses that send only requests from some popular fixed ports like
123, 1024, 1490.

> My guess is that the client does not specify the source port, so for each
> socket a free (not "random") port will be chosen. The implementation rationale
> most likely is that "it's easier", not because "it's better".

I'm not sure if it's really easier. The port assigned by the system
should be random. Do you have an example of a widely used
implementation keeping a socket open which is not also used for
different servers?

> I think I said it before: The server SHOULD still work if the client changes
> the port number (leaving it open to the server to assume that it's a different
> client then), but I would NOT require the client to vary the source port
> number.

It's not meant to be a requirement, just a recommendation.

-- 
Miroslav Lichvar