Re: [Ntp] Antw: Re: Antw: Re: New rev of the NTP port randomization I-D (Fwd: New Version Notification for draft-gont-ntp-port-randomization-01.txt)

["Ulrich Windl" <[e-mail]>]

>>> Harlan Stenn <[e-mail]> schrieb am 29.05.2019 um 12:02 in Nachricht
<[e-mail]>:


[...]
> That also assumes the client has the correct time.  If somebody is using
> SNTP, this assumption may be wrong, and the client's time could well be
> off by much more.  At 33 bits, we're talking about 2 seconds.  If the
> client might be off by 4-8 minutes then we're talking about 41 bits.

Do you really think someone planning to attack NTP will start with a clock that is  minutes off the correct time?

> 
>>>
>>> And remember that:
>>>
>>> - the window of time where an attack is possible starts when the client
>>>   sends its request, and ends when a valid response is received.
>> 
>> An attacker will probably "spray" attacking packets.
> 
> OK, so what?  Low end normal machines might handle 2k packets/second,
> and low end slow machines are lucky to be able to handle 200 packets per
> second.

It there a difference between the client being overloaded with attack packets that are "wrong" or attack packets that are "correct"? I was arguing that "enough packets" could easily be created, while you argue the client can't handle them.

> 
>>> - a competent client will log bogus responses, at least during this
>>>   window, and if the client is NTP as opposed to SNTP, will log
>>>   *any* bogus received packets.
>> 
>> The point is whether logging unexpected packets actually opens a DoS 
> windows.
> 
> That's something logging systems can reasonably be expected to handle,
> and it's also reasonable to assume that if somebody goes to the trouble
> to log these events they're also alerting on them.

Yeah: Filesystem full ;-)

[...]