Re: [Ntp] I-D Action: draft-ietf-ntp-alternative-port-01.txt

[Miroslav Lichvar <[e-mail]>]

On Wed, Feb 17, 2021 at 04:01:24AM -0800, Hal Murray wrote:
> Looks good.
> 
> Do we need to include rate limiting?
> 
> Without rate limiting, an NTP server can be used as a reflector.  I'm not 
> plugged into the crowd that does the anti-DoS work.  How much of a problem is 
> a non-amplifying reflector?

I don't think it's a significant problem. At least I have not heard
about any attacks using a 1:1 NTP reflection. It seems there are many
other protocols (e.g. ICMP) that have this property and are not rate
limited by default.

Rate limiting is not a good security mechanism. As you point out,
attackers can avoid it by using a large number of addresses. With IPv6
there is practically an infinite number of them for the attackers to
use.

Rate limiting in NTP is a security issue on its own. It can be
exploited by attackers to deny or degrade the service to legitimate
clients of the server. I think this is a bigger issue than the
reflection.

-- 
Miroslav Lichvar