[Ntp] Antw: Antw: [EXT] Re: WGLC on draft‑ietf‑alternative‑port‑01

>>> "Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de> schrieb am 29.07.2021
um
09:08 in Nachricht <610253DA020000A100042C8B@gwsmtp.uni-regensburg.de>:
>>>> Watson Ladd <watsonbladd@gmail.com> schrieb am 29.07.2021 um 05:12 in
> Nachricht
> <CACsn0ckn+-MTrnd7KLVQCjyGnDPAPhPYYZm6W-w92vtd0PEAgQ@mail.gmail.com>:
>> On Mon, Jul 26, 2021 at 2:05 AM Miroslav Lichvar <mlichvar@redhat.com>
> wrote:
>>>
>>> On Sun, Jul 25, 2021 at 07:46:28PM ‑0400, Danny Mayer wrote:
>>> > I have now come to the conclusion that this should NOT be accepted.
Based
> 
>> on
>>> > a conversation I had recently something like 70% of all traffic is
still
> 
>> NTP
>>> > V3 so this would not have any effect on them. Millions of firewalls
> would
>>> > need to be changed. While the idea is generally good, it's not
> practical.
>>>
>>> The draft is not specific to NTPv4. NTPv3 clients can be updated to
>>> use the alternative port too. On the public servers I'm running, with
>>> one exception (India), the observed NTPv3 share is below 10% anyway.
>>>
>>> > An easier and more practical proposal would be to remove mode 6 and 7
>>> > packets from the existing protocol and require that those types of
> packets
>>> > and information be done on a separate port or even use TCP.
>>>
>>> I don't see how would that be better. If you write a new document that
>>> forbids mode 6/7 on port 123, how will that fix the existing devices
>>> that still respond to it?
>>>
>>> It's now over 7 years since the large‑scale DDoS attacks started. If
>>> everyone fixed configuration of their devices to not respond to the
>>> modes, ISPs wouldn't be using the NTP rate‑limiting middleboxes and we
>>> wouldn't have this discussion.
>>>
>>> Port 123 seems to be doomed, at least for the near future. The
>>> alternative port gives us a way forward. Yes, the adoption on the
>>> global scale will probably take a long time, but at least people who
>>> are most impacted will be able to do something to fix it (update their
>>> NTP servers and clients).
>> 
>> We see issues at Cloudflare with packet delivery on port 123. ISP
>> middleboxes are going to police by length, and an alternative port is
>> the way forward. There is much less policing on the alternative ports.
> 
> Actually I'd think teching cloudflare would be better than changing the 

I had meant to write "teaching"...

> port.
> Otherwise: When do we change the port again?
> 
>> 
>> Sincerely,
>> Watson Ladd
>> 
>>>
>>> ‑‑
>>> Miroslav Lichvar
>>>
>> 
>> 
>> ‑‑
>> Astra mortemque praestare gradatim
>> 
>> _______________________________________________
>> ntp mailing list
>> ntp@ietf.org 
>> https://www.ietf.org/mailman/listinfo/ntp 
> 
> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 