[Ntp] Antw: [EXT] Re: WGLC on draft‑ietf‑alternative‑port‑01

>>> Watson Ladd <watsonbladd@gmail.com> schrieb am 29.07.2021 um 05:12 in
Nachricht
<CACsn0ckn+-MTrnd7KLVQCjyGnDPAPhPYYZm6W-w92vtd0PEAgQ@mail.gmail.com>:
> On Mon, Jul 26, 2021 at 2:05 AM Miroslav Lichvar <mlichvar@redhat.com>
wrote:
>>
>> On Sun, Jul 25, 2021 at 07:46:28PM ‑0400, Danny Mayer wrote:
>> > I have now come to the conclusion that this should NOT be accepted. Based

> on
>> > a conversation I had recently something like 70% of all traffic is still

> NTP
>> > V3 so this would not have any effect on them. Millions of firewalls
would
>> > need to be changed. While the idea is generally good, it's not
practical.
>>
>> The draft is not specific to NTPv4. NTPv3 clients can be updated to
>> use the alternative port too. On the public servers I'm running, with
>> one exception (India), the observed NTPv3 share is below 10% anyway.
>>
>> > An easier and more practical proposal would be to remove mode 6 and 7
>> > packets from the existing protocol and require that those types of
packets
>> > and information be done on a separate port or even use TCP.
>>
>> I don't see how would that be better. If you write a new document that
>> forbids mode 6/7 on port 123, how will that fix the existing devices
>> that still respond to it?
>>
>> It's now over 7 years since the large‑scale DDoS attacks started. If
>> everyone fixed configuration of their devices to not respond to the
>> modes, ISPs wouldn't be using the NTP rate‑limiting middleboxes and we
>> wouldn't have this discussion.
>>
>> Port 123 seems to be doomed, at least for the near future. The
>> alternative port gives us a way forward. Yes, the adoption on the
>> global scale will probably take a long time, but at least people who
>> are most impacted will be able to do something to fix it (update their
>> NTP servers and clients).
> 
> We see issues at Cloudflare with packet delivery on port 123. ISP
> middleboxes are going to police by length, and an alternative port is
> the way forward. There is much less policing on the alternative ports.

Actually I'd think teching cloudflare would be better than changing the port.
Otherwise: When do we change the port again?

> 
> Sincerely,
> Watson Ladd
> 
>>
>> ‑‑
>> Miroslav Lichvar
>>
> 
> 
> ‑‑
> Astra mortemque praestare gradatim
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 