Re: [Ntp] [tsvwg] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Eliot Lear <[e-mail]>]

Hi Joe

On 08.12.21 18:23, [e-mail] wrote:
> Hi, Eliot,
>
> Packets ARE getting to endpoints.
>
> If the issue is that packets of certain *sizes* aren’t getting there, 
> then NTP should find a way around that using the current port. The 
> fact that the existing port is being filtered is on them. Moving to 
> another port simply invites firewall managers to add that number to 
> their current NTP filters.

I'm not sold either way.

Yes, as a rule we do not allocate new ports for existing services.  
There are two reasons for that rule: first, it encourages sloppy design 
of the form ("I'll fix it later") and second and more importantly, we 
simply don't have so many ports to go around.

But this is a fundamental service, and the default behavior for clients 
will simply be to not authenticate.  And that would make NTP an 
attractive nuisance if those port filters are likely to stay.  That's a 
big if.

It is simply not reasonable, however, to require that NTP packets 
comport to a particular size in order to evade a combination of broken 
firewall policies and unbending IANA policies

Miroslav, one question I would like to understand is whether those drops 
involve typical packets used to sync clocks or if those are control 
packets.  In other words, are clocks not syncing because of the drops?

Eliot