Re: [Ntp] I-D Action: draft-ietf-ntp-alternative-port-01.txt

[Hal Murray <[e-mail]>]

Looks good.

Do we need to include rate limiting?

Without rate limiting, an NTP server can be used as a reflector.  I'm not 
plugged into the crowd that does the anti-DoS work.  How much of a problem is 
a non-amplifying reflector?


Assuming we do add rate limiting, what is a sensible limit?  Is there one?

I see two tangles:
  The first is NAT.  I have a couple of servers in the pool.  I set their rate 
limiting to 1 packet per second averaged over 20 seconds.  (you can send a 20 
packet burst)  That limit kicks in frequently with bursts of traffic that I 
think are coming from NAT boxes.  I did confirm one case.

  The second is IPv6.  Rate limiting is typically done by IP Address.  With 
IPv6, a host can have many IP Addresses.  This is really just the tip of an 
iceberg.  Even with IPv4, I can DoS a site by sending to neighboring IP 
Addresses.


-- 
These are my opinions.  I hate spam.