Re: [Ntp] Microbursts of NTP packets

[Hal Murray <[e-mail]>]

[I've been working on this with Steven Sommars.]

> We're observing short bursts of high numbers of NTP queries at one point of
> presence, exceeding the queue length of the listening ntp socket, and leading
> to drops. The bursts are very short, so the overall qps is nothing special.
> I'm quite mystified as to what the possible causes could be. 

You didn't provide any numbers, either for duration or size of burst.  What do 
you consider to be "very short"?

I've been using a gap of 1 second to separate bursts and ignoring bursts with 
less than 1000 packets.

Using tcpdump to gather data, I've seen 2 types of bursts.

Steve mention the bursts from Fortigate.  They are typically a bit under 10 
seconds long with a wide range of rates.  Some are over 150K packets or 15K 
packets/sec.

The other is from systems using NAT.  These bursts are typically 100-180 
seconds long which matches the TTL of the pool DNS info.  The burst rate is 
typically under 25 packets/second with a few over 100.

I confirmed with one admin that his IP address was a NAT box with a lab full 
of systems using the pool.  But that is only one data point so I may be 
jumping to conclusions.

Graphs here:
  http://users.megapathdsl.net/~hmurray/Burst/


> This is unfortunately leading to packet drops. If any operators have seen
> this, their input on possible causes and solutions is welcome. 

You probably want some sort of rate limiting to prevent your systems being 
used as a Reflector during DDoS attacks.


-- 
These are my opinions.  I hate spam.