Re: [Ntp] Antw: [EXT] Re: WGLC on draft‑ietf‑alternative‑port‑01

[Danny Mayer <[e-mail]>]

On 7/29/21 3:08 AM, Ulrich Windl wrote:
>>>> Watson Ladd <[e-mail]> schrieb am 29.07.2021 um 05:12 in
> Nachricht
> <[e-mail]>:
>> On Mon, Jul 26, 2021 at 2:05 AM Miroslav Lichvar <[e-mail]>
> wrote:
>>> On Sun, Jul 25, 2021 at 07:46:28PM ‑0400, Danny Mayer wrote:
>>>> I have now come to the conclusion that this should NOT be accepted. Based
>> on
>>>> a conversation I had recently something like 70% of all traffic is still
>> NTP
>>>> V3 so this would not have any effect on them. Millions of firewalls
> would
>>>> need to be changed. While the idea is generally good, it's not
> practical.
>>> The draft is not specific to NTPv4. NTPv3 clients can be updated to
>>> use the alternative port too. On the public servers I'm running, with
>>> one exception (India), the observed NTPv3 share is below 10% anyway.
>>>
>>>> An easier and more practical proposal would be to remove mode 6 and 7
>>>> packets from the existing protocol and require that those types of
> packets
>>>> and information be done on a separate port or even use TCP.
>>> I don't see how would that be better. If you write a new document that
>>> forbids mode 6/7 on port 123, how will that fix the existing devices
>>> that still respond to it?
>>>
>>> It's now over 7 years since the large‑scale DDoS attacks started. If
>>> everyone fixed configuration of their devices to not respond to the
>>> modes, ISPs wouldn't be using the NTP rate‑limiting middleboxes and we
>>> wouldn't have this discussion.
>>>
>>> Port 123 seems to be doomed, at least for the near future. The
>>> alternative port gives us a way forward. Yes, the adoption on the
>>> global scale will probably take a long time, but at least people who
>>> are most impacted will be able to do something to fix it (update their
>>> NTP servers and clients).
>> We see issues at Cloudflare with packet delivery on port 123. ISP
>> middleboxes are going to police by length, and an alternative port is
>> the way forward. There is much less policing on the alternative ports.
> Actually I'd think teaching cloudflare would be better than changing the port.
> Otherwise: When do we change the port again?

When NTPv5 comes along it will have a larger packet size, so how is this 
different? In addition there's the problem of extension fields which 
also increase the size of the packet including the NTS-enabled ones. 
It's much more important to figure out how these middleboxes and 
firewalls should handle NTP packets and provide better guidance.

Danny