Re: [Ntp] Garbage NTP request packets

[Erik Kline <[e-mail]>]

We do need to recharter the group if it's going to work on NTPv5 ("The goal
of this working group is to document NTPv4..." :-).  We could float the
idea of including operational "care and feeding" of all NTP versions in the
to-be-proposed scope of work.

On Wed, Sep 23, 2020 at 7:18 PM Watson Ladd <[e-mail]> wrote:

> Isn't there a rechartering where we get to define the scope due? I may
> have promised to write a draft charter, but know nothing about such
> matters: will ask around at work.
>
> Such a charter could, AFAIK, include operational issues: I know there
> is a dnsops WG.  Whether or not that's desirable or effective is
> another question, and I'm not aware of other fora for NTP operational
> questions to be discussed. It's certainly something that has to be
> considered in future standardization.
>
> On Wed, Sep 23, 2020 at 3:49 PM Daniel Franke <[e-mail]>
> wrote:
> >
> > Danny, I agree that Hal's question is slightly off-topic for this list
> > but I can't think of any better forum for it. The people who should
> > see it are all here; I don't they're all anywhere else. Is it worth
> > spinning up a new list for this sort of thing? Something like an
> > implementation-neutral forum for NTP developers and public server
> > operators?
> >
> > On Wed, Sep 23, 2020 at 3:35 PM Danny Mayer <[e-mail]> wrote:
> > >
> > > Was there a working group question in here?
> > >
> > > On 9/23/20 4:44 AM, Miroslav Lichvar wrote:
> > > > On Tue, Sep 22, 2020 at 10:34:13PM -0700, Hal Murray wrote:
> > > >> I noticed that an error counter that was going off more than I
> expected, so I
> > > >> hacked a server to print out a few garbage requests.
> > > > I think that's normal. On my public servers I see all kinds of weird
> > > > requests.
> > > >
> > > >> Ones like this happen often enough to attract my attention.
> > > >>   e3000000 00000000 00000000 00000000
> > > >>   00000000 00000000 00000000 00000000
> > > >>   00000000 00000000 00000000 00000000
> > > >>   00000020 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
> ffffffff
> > > >>
> > > >> The first 3 lines look like a version 4 request.  The last line
> starts to look
> > > >> like a MAC using key 20 (hex) but the HMAC/CMAC part is 28 bytes.
> I haven't
> > > >> setup key 20 and our code doesn't support bare MACs with a total
> length of 32
> > > >> bytes.
> > > > This example looks like a valid NTPv4 request to me. It's not a MAC,
> > > > but an extension field (type 0, length 32 octets).
> > > >
> > > > I have a script for monitoring pool.ntp.org servers that sends
> > > > requests like that (and others) to check various features of the
> > > > server like whether it can respond to an unknown extension field,
> what
> > > > implementation it is running, etc. FWIW, a server that doesn't
> respond
> > > > to a request that has an unknown extension field makes it more
> > > > difficult for clients to detect whether the extension field is
> > > > supported.
> > > >
> > >
> > > _______________________________________________
> > > ntp mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/ntp
> >
> > _______________________________________________
> > ntp mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/ntp
>
>
>
> --
> Astra mortemque praestare gradatim
>
> _______________________________________________
> ntp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ntp
>