[Ntp] Antw: [EXT] Re: WGLC on draft‑ietf‑alternative‑port‑01

>>> Miroslav Lichvar <mlichvar@redhat.com> schrieb am 26.07.2021 um 11:05 in
Nachricht <YP562akF+CL/9R5s@localhost>:
> On Sun, Jul 25, 2021 at 07:46:28PM ‑0400, Danny Mayer wrote:
>> I have now come to the conclusion that this should NOT be accepted. Based
on
>> a conversation I had recently something like 70% of all traffic is still
NTP
>> V3 so this would not have any effect on them. Millions of firewalls would
>> need to be changed. While the idea is generally good, it's not practical.
> 
> The draft is not specific to NTPv4. NTPv3 clients can be updated to
> use the alternative port too. On the public servers I'm running, with
> one exception (India), the observed NTPv3 share is below 10% anyway.
> 
>> An easier and more practical proposal would be to remove mode 6 and 7
>> packets from the existing protocol and require that those types of packets
>> and information be done on a separate port or even use TCP.

Actually I think removing mode 6 from the protocol is a bad idea:
So (assuming there is a need for monitoring and dynamic configuration) every
implementer will do his/her own protocol.
As a matter of fact crony does not document the internal protocol being used.
Despite of not being compatible with the popular NTP implementation, that would
require to call a process instead of sending out a few network packets.
Obviously when monitoring a bigger landscape this is highly inefficient.
The implementation of NTP in Microsoft Windows is a similar case.

Regards,
Ulrich Windl

> 
> I don't see how would that be better. If you write a new document that
> forbids mode 6/7 on port 123, how will that fix the existing devices
> that still respond to it?
> 
> It's now over 7 years since the large‑scale DDoS attacks started. If
> everyone fixed configuration of their devices to not respond to the
> modes, ISPs wouldn't be using the NTP rate‑limiting middleboxes and we
> wouldn't have this discussion.
> 
> Port 123 seems to be doomed, at least for the near future. The
> alternative port gives us a way forward. Yes, the adoption on the
> global scale will probably take a long time, but at least people who
> are most impacted will be able to do something to fix it (update their
> NTP servers and clients).
> 
> ‑‑ 
> Miroslav Lichvar
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 