Re: [Ntp] I-D Action: draft-ietf-ntp-alternative-port-00.txt

[Miroslav Lichvar <[e-mail]>]

On Sat, Oct 24, 2020 at 11:40:56AM -0500, Steven Sommars wrote:
> (comment) The ALTPORT could be used for NTS only (my preference). However I
> don't object to ALTPORT being used for both NTS and RFC5905 as described in
> this draft.

As the problems with blocking and rate-limiting are not specific to
NTS-protected NTP packets, I think it would be nice to provide a
workaround for all servers and clients, not just those that are using
NTS. I don't think we can expect NTS to be instantly adopted
everywhere.

> Abstract:  "in order to make NTP safe for the Internet."
> NTP behavior is improved, but since it is UDP based there is still
> opportunity for abuse.

Do you suggest to reword the abstract to mention only that it makes
NTP amplification-free?

> Section 1.  "Over time, network operators have been observed to implement
> the following mitigations"
> - The mitigations are undocumented, path/operator dependent and may change
> over time.

Ok. I'll try to improve that section.

> Section 1. "The number of public servers in the pool.ntp.org project has
> dropped  in large part due to the mitigations (citation?)."
> I am unaware of a good citation.  Several threads in
> https://community.ntppool.org/ describe problems with NTP Pool monitoring,
> i.e., unexpected low monitoring scores.
> Some incidents resulted in machines being temporarily or permanently
> removed from the NTP pool.
> I doubt there is data to back up the "in large part" comment.

Maybe we could at least say that the number of servers dropped due to
the attacks, no matter why exactly were the servers removed? The graph
at this page clearly shows when it started:

https://www.ntppool.org/zone

> Section 2.
>   "The client SHOULD be switching between the two ports until a valid
> response is received."
> to
>    The client SHOULD alternate between the two ports until a valid response
> is received.

Ok.

> Are there any issues with an NTP server keeping state information for both
> clients at both (IP, port 123) and (IP,ALTPORT)?

I suspect it would be an unnecessary complication wasting memory.

> E.g., Client sends queries on the two ports, server receives both.  Does
> the server consider these to be two clients or one?

I think it should still count as one address, which can have multiple
clients. Servers usually don't care about the client's port, so I
don't see a reason why they would want to care about the server's
port. Before the server port, it would make more sense to consider the
server address on multihomed hosts. The server port should just limit
the responses to those that don't cause amplification.

Thanks,

-- 
Miroslav Lichvar