Re: [Ntp] Garbage NTP request packets

Isn't there a rechartering where we get to define the scope due? I may
have promised to write a draft charter, but know nothing about such
matters: will ask around at work.

Such a charter could, AFAIK, include operational issues: I know there
is a dnsops WG.  Whether or not that's desirable or effective is
another question, and I'm not aware of other fora for NTP operational
questions to be discussed. It's certainly something that has to be
considered in future standardization.

On Wed, Sep 23, 2020 at 3:49 PM Daniel Franke <dfoxfranke@gmail.com> wrote:
>
> Danny, I agree that Hal's question is slightly off-topic for this list
> but I can't think of any better forum for it. The people who should
> see it are all here; I don't they're all anywhere else. Is it worth
> spinning up a new list for this sort of thing? Something like an
> implementation-neutral forum for NTP developers and public server
> operators?
>
> On Wed, Sep 23, 2020 at 3:35 PM Danny Mayer <mayer@ntp.org> wrote:
> >
> > Was there a working group question in here?
> >
> > On 9/23/20 4:44 AM, Miroslav Lichvar wrote:
> > > On Tue, Sep 22, 2020 at 10:34:13PM -0700, Hal Murray wrote:
> > >> I noticed that an error counter that was going off more than I expected, so I
> > >> hacked a server to print out a few garbage requests.
> > > I think that's normal. On my public servers I see all kinds of weird
> > > requests.
> > >
> > >> Ones like this happen often enough to attract my attention.
> > >>   e3000000 00000000 00000000 00000000
> > >>   00000000 00000000 00000000 00000000
> > >>   00000000 00000000 00000000 00000000
> > >>   00000020 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
> > >>
> > >> The first 3 lines look like a version 4 request.  The last line starts to look
> > >> like a MAC using key 20 (hex) but the HMAC/CMAC part is 28 bytes.  I haven't
> > >> setup key 20 and our code doesn't support bare MACs with a total length of 32
> > >> bytes.
> > > This example looks like a valid NTPv4 request to me. It's not a MAC,
> > > but an extension field (type 0, length 32 octets).
> > >
> > > I have a script for monitoring pool.ntp.org servers that sends
> > > requests like that (and others) to check various features of the
> > > server like whether it can respond to an unknown extension field, what
> > > implementation it is running, etc. FWIW, a server that doesn't respond
> > > to a request that has an unknown extension field makes it more
> > > difficult for clients to detect whether the extension field is
> > > supported.
> > >
> >
> > _______________________________________________
> > ntp mailing list
> > ntp@ietf.org
> > https://www.ietf.org/mailman/listinfo/ntp
>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp

-- 
Astra mortemque praestare gradatim