Re: [Ntp] [tsvwg] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Danny Mayer <[e-mail]>]

On 12/6/21 5:00 AM, Miroslav Lichvar wrote:
> On Sun, Dec 05, 2021 at 03:20:12PM -0800, C. M. Heard wrote:
>> We have two contradictory assertions by proponents of the alternate port.
>> Which, if either, is correct?
>>
>> Are the servers largely fixed but the filters still in place out of
>> inertia, as Mr. Sommers says?
>>
>> Or do the filters remain because of servers that have not been fixed, as
>> Mr. Murray says?
> I suspect we won't know for sure as long as NTP is firewalled
> everywhere.
>
> The reality is that NTP doesn't work reliably over Internet. In the
> community of people running public servers (pool.ntp.org) it's the
> number one problem. My impression is that it's getting worse over
> time.
That's untrue. It's been working for over 25 years and probably longer. 
The real issue here is that there are firewalls and routers blocking 
packets longer than 48 bytes, yet I've watch autokey do its dance with 
packet lengths much longer. What you are trying to do is circumvent 
these firewall and router rules to get NTP to work with larger packets 
but on a new port and you will still have to set the rules to allow it. 
Like EDNS0 adjusting the existing rules on port 123 is a much better 
solution. Removing or restricting support for mode 6 and 7 packets is 
trivial and requires no additional complexity. You're just trying to 
move the underlying problem from one place to the other.
>
> With NTS, which uses longer NTP messages it's quite common to see a
> client that doesn't get a response to most of its requests.
Fix the firewall rules.
>
> The major ISPs have middleboxes, which cannot be configured to
> specifically block or rate limit the amplifiying mode-6/7 messages.
> Better hardware could be designed, but who will pay for that?
> Expecting all those existing servers that amplify the traffic to be
> fixed and the middleboxes to be disabled doesn't seem to be realistic.
>
No, instead you should be fixing the servers to not reply to mode 6/7 
packets instead. In the NTP Reference implementation it's trivial to 
update the configuration. In other implementations that's a SMOP if it's 
not already there.

Danny