[Ntp] Antw: [EXT] Re: Symmetric mode

[Ulrich Windl <[e-mail]>]

>>> Miroslav Lichvar <[e-mail]> schrieb am 29.09.2022 um 16:41 in
Nachricht <YzWunE8uQwTh8suS@localhost>:
> On Thu, Sep 29, 2022 at 02:45:24AM ‑0700, Hal Murray wrote:
>> If one side says "peer other" and the other side doesn't say anything I get

>> the symmetric active/passive pair you describe.
>> 
>> I was expecting an ephemeral slot to show up in ntpq ‑p but I haven't seen

> it. 
>> Maybe I haven't got the restrict stuff right.  I tried
>>   restrict default notrap
>> with all other restrict stuff commented out.  Can anybody confirm that this

>> ephemeral association does or doesn't show up in ntpq ‑p?  Is crypto now 
>> required?  ???
> 
> You need to either add "disable auth" to ntp.conf, or configure a
> symmetric key on both hosts and add it to the peer directive.
> 
> ntpq ‑p (or ntpq ‑c peers) prints emphemeral symmetric associations,
> but only if there was a valid response (reachable). If you just replay
> a packet from a different address or port, the association will not be
> printed by ntpq ‑c peers.
> 
> You need to use the ntpq ‑c lpeers command to see all associations,
> but that works only up to a certain number of association which can be
> listed in a single mode‑6 response. There is also a limit due to the
> 16‑bit type of the association ID. With more than 65535 associations
> some will be completely invisible and other interesting things may
> start to happen. I'd expect the daemon to crash at some point due to
> running out of memory, or at least become so slow it's no longer doing
> anything useful.

I guess the original assumption was that there will never be as many as 2^16
peers, and I'd consider it to be an implementation bug if the internal list of
associations exceeds the number of representable associations.
Maybe the reference implementation could also have a "tos maxclock" to limit
the number of associations. However then the "bad ones" might block the "good
ones".

> 
> If you limit the addresses and port from which can be created
> ephemeral associations, you get basically the same thing as a
> permanent association.
> 
> ‑‑ 
> Miroslav Lichvar
> 
> _______________________________________________
> ntp mailing list
> [e-mail] 
> https://www.ietf.org/mailman/listinfo/ntp