Re: [Ntp] [EXT] KISS => NAT => Rate limiting

Hi!

I think it's a complex topic. Obviously if clients do what they want, and servers do what they want, that would break any protocol.
So obviously clients should be well-behaving, and servers should enforce some policy, at least as an option.
And I think it's important to at least try to inform clients about the policy decisions at the server's side.

And there are always exceptions to the rule. I admit that I mis-use NTP occasionally to evaluate the quality of the network, collecting long-term statistics, but also doing some rapid bursts of NTP packets (in our LAN).
In the past there were some valid surveys collecting data from many servers, while today such "surveys" might be considered to be DDoS attacks.

Finally wanting anonymous clients makes it hard to "respond" to a specific client. So I think "anonymous client" (call it "data minimization") should be an option, not necessarily the default.
I guess public servers don't want to be "anonymous clients".

Just a few thoughts...

Kind regards,
Ulrich WIndl

-----Original Message-----
From: ntp <ntp-bounces@ietf.org> On Behalf Of Hal Murray
Sent: Friday, November 3, 2023 4:09 AM
To: NTP WG <ntp@ietf.org>
Cc: Hal Murray <halmurray+ietf@sonic.net>
Subject: [EXT] [Ntp] KISS => NAT => Rate limiting

Yet another problem with KISS is that it doesn't work with NAT.  A server 
can't distinguish a slightly misbehaving client from a handful of clients 
behind a NAT box.

With modern gear, is there any reason to tell a well behaving client to slow 
down?  Should we pick a number, say 64 seconds, and say "Get permission from 
the operator if you want to send faster than that."?  How does that work with 
iburst or ntpdate that send several packets on short intervals and then become 
reasonable?

NAT gets involved with another tangle.  Do we need to think about rate 
limiting so NTP servers can't be used as reflectors to hide the true source of 
a DoS attack?  Is there an IETF group that thinks about UDP and rate limiting?

I've been using a limit of 1 packet per second on a couple of pool servers.  
That seems generous.  I've got a 20 second time constant on the filter so 
short bursts will work.  Even if they are all polling at 64 seconds, that will 
handle several boxes behind NAT.  (Handwave about getting started if they use 
iburst and all start at the same time like after a power failure and you are 
on the high side of several...)

If you look at the traffic, and ignore the known broken senders, there is 
another layer of busy boxes.  They are borderline abusive, more than 1 packet 
per second, less than 1000s that we get from the seriously broken boxes.  I 
think they are NAT.  I should probably try harder to contact the owners...

I can see 2 approaches to getting around rate limiting if we decide that is 
appropriate.

One is to get ISPs to run NTP servers and their customers to use them.

The other is to setup a registry for IP Addresses of NAT boxes and have the 
servers allow more traffic from them.

Any other ideas?

-- 
These are my opinions.  I hate spam.

_______________________________________________
ntp mailing list
ntp@ietf.org
https://www.ietf.org/mailman/listinfo/ntp