Re: [Ntp] New I-D: NTP Port Randomization (draft-gont-ntp-port-randomization-00.txt)

[Miroslav Lichvar <[e-mail]>]

On Wed, Apr 24, 2019 at 01:17:43AM +0200, Fernando Gont wrote:
> On 23/4/19 10:48, Miroslav Lichvar wrote:
> > Yes, ntpd and ntpdate (without -q or -d) seem to be in the minority of
> > clients using source port 123.
> 
> Any clues whether in other cases they explicitly randomize the source
> port, or rely on the kernel doing port randomization?

I think most, if not all, rely on the OS to do that. When there is no
OS, it seems it's common to use a fixed port, but different from 123.
There are many peaks in the port distribution observed on servers.

> Stupid question: Can the peer doing active mode assume that the other
> peer will be using passive mode? I don't recall of the top of my head:
> is symmetric mode where both peers employ active mode supported? (as in
> e.g. TCP simultaneous open)

It depends on the configuration. If a peer has the other peer
specified in the config, it's using the active mode. There could be an
option to enable random source port for the case when I know the other
peer doesn't have this one specified in the config (e.g. because it's
behind NAT).

> OTOH, if symmetric mode where both endpoints do active mode is
> supported, then it would seem to me it wouldn't be possible to randomize
> the port on symmetric mode -- since otherwise you wouldn't know which
> port to connect to.

In the general case yes, but it could be enabled in the configuration file.

-- 
Miroslav Lichvar