Re: [Ntp] I-D Action: draft-ietf-ntp-alternative-port-00.txt

[Steven Sommars <[e-mail]>]

My comments on
https://datatracker.ietf.org/doc/html/draft-ietf-ntp-alternative-port-00

This draft is important since eliminating UDP port 123 filtering is
unlikely.   The parties responsible for NTP filtering seem reluctant to
even discuss the subject; I've tried.

This note provides some NTP filtering field experience:
https://weberblog.net/ntp-filtering-delay-blockage-in-the-internet/

(comment) The ALTPORT could be used for NTS only (my preference). However I
don't object to ALTPORT being used for both NTS and RFC5905 as described in
this draft.

Abstract:  "in order to make NTP safe for the Internet."
NTP behavior is improved, but since it is UDP based there is still
opportunity for abuse.

Section 1.  "Over time, network operators have been observed to implement
the following mitigations"
- The mitigations are undocumented, path/operator dependent and may change
over time.
- (comment) On some paths I've observed NTP-specific delay.  This may be a
side effect of rate limiting.

Section 1. "The number of public servers in the pool.ntp.org project has
dropped  in large part due to the mitigations (citation?)."
I am unaware of a good citation.  Several threads in
https://community.ntppool.org/ describe problems with NTP Pool monitoring,
i.e., unexpected low monitoring scores.
Some incidents resulted in machines being temporarily or permanently
removed from the NTP pool.
I doubt there is data to back up the "in large part" comment.

Section 2.
  "The client SHOULD be switching between the two ports until a valid
response is received."
to
   The client SHOULD alternate between the two ports until a valid response
is received.

Are there any issues with an NTP server keeping state information for both
clients at both (IP, port 123) and (IP,ALTPORT)?
E.g., Client sends queries on the two ports, server receives both.  Does
the server consider these to be two clients or one?




Steve Sommars