Re: [Ntp] WGLC on draft-ietf-alternative-port-01

[Watson Ladd <[e-mail]>]

On Mon, Jul 26, 2021 at 2:05 AM Miroslav Lichvar <[e-mail]> wrote:
>
> On Sun, Jul 25, 2021 at 07:46:28PM -0400, Danny Mayer wrote:
> > I have now come to the conclusion that this should NOT be accepted. Based on
> > a conversation I had recently something like 70% of all traffic is still NTP
> > V3 so this would not have any effect on them. Millions of firewalls would
> > need to be changed. While the idea is generally good, it's not practical.
>
> The draft is not specific to NTPv4. NTPv3 clients can be updated to
> use the alternative port too. On the public servers I'm running, with
> one exception (India), the observed NTPv3 share is below 10% anyway.
>
> > An easier and more practical proposal would be to remove mode 6 and 7
> > packets from the existing protocol and require that those types of packets
> > and information be done on a separate port or even use TCP.
>
> I don't see how would that be better. If you write a new document that
> forbids mode 6/7 on port 123, how will that fix the existing devices
> that still respond to it?
>
> It's now over 7 years since the large-scale DDoS attacks started. If
> everyone fixed configuration of their devices to not respond to the
> modes, ISPs wouldn't be using the NTP rate-limiting middleboxes and we
> wouldn't have this discussion.
>
> Port 123 seems to be doomed, at least for the near future. The
> alternative port gives us a way forward. Yes, the adoption on the
> global scale will probably take a long time, but at least people who
> are most impacted will be able to do something to fix it (update their
> NTP servers and clients).

We see issues at Cloudflare with packet delivery on port 123. ISP
middleboxes are going to police by length, and an alternative port is
the way forward. There is much less policing on the alternative ports.

Sincerely,
Watson Ladd

>
> --
> Miroslav Lichvar
>


--
Astra mortemque praestare gradatim