Re: [Ntp] [EXT] Re: I-D Action: draft-ietf-ntp-alternative-port-00.txt

[Steven Sommars <[e-mail]>]

The NTP mode 7 monlist command has been used since 2013/2014 for DDoS
attacks.
As a countermeasure UDP port 123 traffic was/is filtered (dropped) on the
Internet by Zayo,
Telia, AT&T, CenturyLink and others.

NTP filtering interferes with NTS and the NTP pool on some paths.

Remote access to the monlist and other mode 6/7 commands has since been
reduced, removed, modified or
administratively disabled on many (probably most) public NTP servers.  I
have not found any current,
specific technical reasons why NTP filtering is still in place.  The ISPs I
contacted gave only vague
references to the monlist issue, if they responded at all.

   Miroslav: NTS doesn't prevent the port from reflecting traffic
Won't NTS simplify mitigation?   I thought crypto overhead would throttle
attacks in software
implementations.

   Ulrich: Rate limiting in case of NTP means "random packet dropping"?
Rate limiting is outside the scope of Miroslav's draft.  So I won't make a
proposal here.

   Miroslav: Is a 1:1 reflection property normally considered to be a
security issue?
I thought UDP reflection attacks were still an issue.   See this 2017
article: https://blog.cloudflare.com/reflections-on-reflections/


Since RFC8915(NTS) has been published and since popular NTP implementations
include NTS support
perhaps ISPs will see increasing end-user dissatisfaction and eliminate or
refine the port 123NTP
filtering.  I doubt it though.  The alternate port seems necessary for
widespread NTS deployment.

Will the Internet treat ALTPORT NTP/NTS nicely, without the type of
filtering seen on port 123?
I don't know.


Steve Sommars