Re: [Ntp] New rev of the NTP port randomization I-D (Fwd: New Version Notification for draft-gont-ntp-port-randomization-01.txt)

[Danny Mayer <[e-mail]>]

On 5/29/19 4:41 AM, Fernando Gont wrote:
> On 29/5/19 04:30, Harlan Stenn wrote:
>> On 5/29/2019 12:07 AM, Fernando Gont wrote:
>>> On 29/5/19 02:06, Harlan Stenn wrote:
>>>> On 5/28/2019 10:58 PM, [e-mail] wrote:
>>>>> Yes Harlen if you know you are being attacked the server can set itself
>>>>> as unavailable or untrustable until it recertifies. Information
>>>>> integrity is key for historical auditing of timestamps 
>>>> What about attacks against the client?
>>>>
>>>> Is there benefit to the client knowing it is being attacked?
>>> If you want that, you are free to run a NIDS. You get attack detection,
>>> without leaking the "session ID".
>> Sorry, I'm not buying that.
>>
>> It cost-shifts too much, and it isn't feasible for a number of
>> significant use cases.
> I don't get why you'd want a known port number. You want attack packets
> to hit the session, and count packets for which the org timer fails to
> validate?
>
> If so: what's the point?
>
What session? There is no session in either UDP or NTP. If you think
there is, please tells us where to find it.

Danny