[Ntp] Rate limiting: DDoS, KoD, Pool, NAT

[Hal Murray <[e-mail]>]

The rate limiting parameters in ntpd were carefully setup to support iburst 
from a single client at an IP Address.  With NAT now widely deployed, a single 
client per IP Address is no longer a valid assumption.

I have a couple of servers in the pool.  Rate limiting is disabled to support 
NAT.  I watch the MRU statistics, looking for piggy/abusive users.  Samples 
below.

I've seen a few samples that look like NAT and some that look like abuse.

Has anybody else considered this area?  Is there a rate limiting that will 
serve NAT sites without being useful for DoS redirection?

Does KoD make sense when NAT might be in use?  Are there cases where it does 
make sense and the client software will pay attention?

Do we need something like a registry for NAT sites with lots of clients?

What else is tangled up in this area?


 lstint avgint rstr r m v  count rport remote address
=====================================================
  45551  0.000   d0 . 3 4 113844   123 80.227.74.22
  45552  0.001   d0 . 3 4  16861   123 83.111.252.81
  10428  0.001   d0 . 3 3 182510   123 201.137.1.30
   2921  0.001   d0 . 3 3 152890   123 206.41.87.114
  52234  0.002   d0 . 3 3  99361   123 41.248.137.100
  29652  0.004   d0 . 3 4  20070   123 24.142.249.46
   4198  0.019   d0 . 3 4   6833   770 79.238.21.109
  30988  0.029    0 . 6 2  12273 47130 ::1
  45987  0.031   d0 . 3 3   1814 56808 2a02:c7f:5e2d:ea00:3402:95ae:ae2b:3df3
  19252  0.037   d0 . 3 4   1536 50968 207.177.62.245
  24671  0.041   d0 . 3 4   3539 52423 100.16.244.234
   1014  0.041   d0 . 3 4   2240 20139 159.100.164.32
  55206  0.044   d0 . 3 4   3552  3796 38.111.102.2
  43232  0.057   d0 . 3 3   1962 47778 223.196.172.241
  47928  0.064   d0 . 3 4   2416 26154 4.14.1.34


-- 
These are my opinions.  I hate spam.