Re: [Ntp] NTPv5 Loop Detection without Stratum

[Danny Mayer <[e-mail]>]

On 8/23/22 6:21 AM, Heiko Gerstung wrote:
> One way of avoiding/detecting loops:
> - upon startup, an NTPv5 instance creates a random 64bit ID
> - we add a loop detection EF that can include n IDs (or we use n EFs)
> - a stratum one server, when ask for his "sync trace", responds with only his ID
> - a stratum two server would add its own ID to the ID of its upstream server, responding with a sync trace of two IDs
> - a stratum 1+n server would respond with the sync trace of its upstream source(s) plus its own ID
> - if you use more than one upstream source, you can respond with a list of all IDs from the sync trace of all your upstream sources (removing duplicates)
> - by checking if your own ID is in the sync trace of your upstream source(s), you can find out if there is a loop
>
> Maybe smaller IDs (32 bit, 16 bit) would be OK as well. 10 IDs would be 80 octets on the wire. No question that we would have to find a way to avoid amplification attacks (hello monlist!). Maybe by making it mandatory to send a request (with padding bytes) that is as big as the worst case response.
>
> Regards,
>    Heiko

You only need one reference ID. You don't need to go all the way back up 
the chain.

Danny