Re: [Ntp] NTP version 1 requests

[Paul Gear <[e-mail]>]

I took a sample of traffic coming into my pool servers over a 2-hour
period.  I've only done some very basic analysis, but I see between
about 0.6% and 2.1% of NTP traffic is v1.

I looked at some of the differences between received packets (mode &
root dispersion are the most obvious), and looked up a few IPs in
Shodan, and I'd say there are at least 2 or 3 different implementations
involved.

One looks to be a particular Cisco model often used for IPsec VPNs,
probably supplied by TPG Internet (or one of the companies it bought
out) here in Australia, and another appears to be an embedded platform
used by an ISP in the Philippines.  (The population is probably skewed,
since my servers are in the AU & Oceania pools.)

I don't have a paid Shodan account, so I can't do a full analysis, but
I'm happy to share the packet captures if someone else has better tools
for reconnaissance on the IPs.

Regards,
Paul

On 23/6/20 4:03 am, Hal Murray wrote:
> I have a couple of servers in the pool.  They get version 1 requests.
>
> Does anybody know what software package and/or OS/distro they are coming from?
>
> 0.25% in San Francisco
> 0.025% in London
>
>