[Ntp] Antw: Re: Antw: Re: I-D Action: draft-ietf-ntp-port-randomization-00.txt

>>> Miroslav Lichvar <mlichvar@redhat.com> schrieb am 13.11.2019 um 17:00 in
Nachricht <20191113160055.GC2634@localhost>:
> On Wed, Nov 13, 2019 at 12:49:32PM +0100, Ulrich Windl wrote:
>> >>> Miroslav Lichvar <mlichvar@redhat.com> schrieb am 13.11.2019 um 12:21
in
>> > ‑ It seems to be the current practice. From the implementations
>> >   that I'm familiar with and that use a random source port, each one
>> >   opens a new socket for each request, at least by default. On my
>> >   public servers I see that most clients do change their port over
>> >   time.
>> 
>> >From remote you cannot know whether it's the same instance of the same 
> client
>> sending the requests.
> 
> Yes, there could be multiple clients (e.g. behind NAT), but I think we
> can make a good guess whether any of them use a stable port by
> counting how many requests are there per port. When I analyze 24-hour
> captures from public servers in few different countries, for most
> addresses there seem to be only one request per port. I'm ignoring
> addresses that send only requests from some popular fixed ports like
> 123, 1024, 1490.

So your result is more or less biased: What if that fixed popular ports are
99% of all requests? Then you are csaling up the remaining 1% to support your
view. That's not serious argumenting.

> 
>> My guess is that the client does not specify the source port, so for each
>> socket a free (not "random") port will be chosen. The implementation 
> rationale
>> most likely is that "it's easier", not because "it's better".
> 
> I'm not sure if it's really easier. The port assigned by the system
> should be random. Do you have an example of a widely used
> implementation keeping a socket open which is not also used for
> different servers?

I mean this: If the client specified a specific port, the client has to make
sure that the port isn't in use. If you specify 0 as port, the system picks a
free one for you. Thats easier.

> 
>> I think I said it before: The server SHOULD still work if the client
changes
>> the port number (leaving it open to the server to assume that it's a 
> different
>> client then), but I would NOT require the client to vary the source port
>> number.
> 
> It's not meant to be a requirement, just a recommendation.
> 
> -- 
> Miroslav Lichvar
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 