[Ntp] KISS => NAT => Rate limiting

[Hal Murray <[e-mail]>]

Yet another problem with KISS is that it doesn't work with NAT.  A server 
can't distinguish a slightly misbehaving client from a handful of clients 
behind a NAT box.

With modern gear, is there any reason to tell a well behaving client to slow 
down?  Should we pick a number, say 64 seconds, and say "Get permission from 
the operator if you want to send faster than that."?  How does that work with 
iburst or ntpdate that send several packets on short intervals and then become 
reasonable?


NAT gets involved with another tangle.  Do we need to think about rate 
limiting so NTP servers can't be used as reflectors to hide the true source of 
a DoS attack?  Is there an IETF group that thinks about UDP and rate limiting?


I've been using a limit of 1 packet per second on a couple of pool servers.  
That seems generous.  I've got a 20 second time constant on the filter so 
short bursts will work.  Even if they are all polling at 64 seconds, that will 
handle several boxes behind NAT.  (Handwave about getting started if they use 
iburst and all start at the same time like after a power failure and you are 
on the high side of several...)

If you look at the traffic, and ignore the known broken senders, there is 
another layer of busy boxes.  They are borderline abusive, more than 1 packet 
per second, less than 1000s that we get from the seriously broken boxes.  I 
think they are NAT.  I should probably try harder to contact the owners...



I can see 2 approaches to getting around rate limiting if we decide that is 
appropriate.

One is to get ISPs to run NTP servers and their customers to use them.

The other is to setup a registry for IP Addresses of NAT boxes and have the 
servers allow more traffic from them.

Any other ideas?


-- 
These are my opinions.  I hate spam.