Re: [Ntp] WGLC on draft-ietf-alternative-port-01

[Miroslav Lichvar <[e-mail]>]

On Sun, Jul 25, 2021 at 07:46:28PM -0400, Danny Mayer wrote:
> I have now come to the conclusion that this should NOT be accepted. Based on
> a conversation I had recently something like 70% of all traffic is still NTP
> V3 so this would not have any effect on them. Millions of firewalls would
> need to be changed. While the idea is generally good, it's not practical.

The draft is not specific to NTPv4. NTPv3 clients can be updated to
use the alternative port too. On the public servers I'm running, with
one exception (India), the observed NTPv3 share is below 10% anyway.

> An easier and more practical proposal would be to remove mode 6 and 7
> packets from the existing protocol and require that those types of packets
> and information be done on a separate port or even use TCP.

I don't see how would that be better. If you write a new document that
forbids mode 6/7 on port 123, how will that fix the existing devices
that still respond to it?

It's now over 7 years since the large-scale DDoS attacks started. If
everyone fixed configuration of their devices to not respond to the
modes, ISPs wouldn't be using the NTP rate-limiting middleboxes and we
wouldn't have this discussion.

Port 123 seems to be doomed, at least for the near future. The
alternative port gives us a way forward. Yes, the adoption on the
global scale will probably take a long time, but at least people who
are most impacted will be able to do something to fix it (update their
NTP servers and clients).

-- 
Miroslav Lichvar