[Ntp] DDoS meets NTP

[Hal Murray <[e-mail]>]

[e-mail] said:
> What is worse, it can be exploited for a DoS attack on real NTP clients if it
> doesn't randomly let some packets through. 

How many is "some"?  What fraction of the responses does a client need?

Is this a solvable problem?  If I let 1/N through, is there a value of N that 
lets through enough real replies without also letting through enough bogus 
traffic to make traditional DDoS practical?

There is a horrible complication in this area: NAT.  If there are X clients 
behind a NAT box, then that IP Address needs X times as much legitimate 
traffic.

--------

One tool in this area is to have the NTS cookies tied to an IP Address.  We 
discussed this a long time ago.  Nobody was interested, but I've forgotten 
why.  Maybe it was more important to allow laptops to keep using their cookies 
across migrations that change IP Addresses.

We could make it an option.  Then people with fixed addresses could turn it on 
and servers could have 2 modes of rate limiting.  That doesn't help if the bad 
guy can capture traffic from the client.  The server can't tell a replay from 
normal traffic.

--------

Is there any group within IETF where DDoS discussions would be appropriate?



-- 
These are my opinions.  I hate spam.