[Ntp] Antw: Re: Antw: [EXT] Re: Quick review of WGLC for status change for draft‑ietf‑ntp‑update‑registries

[Ulrich Windl <[e-mail]>]

>>> Martin Burnicki <martin.burnicki=[e-mail]> schrieb am
09.08.2022 um 13:06 in Nachricht
<[e-mail]>:
> Miroslav Lichvar wrote:
>> On Tue, Aug 09, 2022 at 12:46:05PM +0200, Martin Burnicki wrote:
>>> Hal Murray wrote:
>>>> You haven't looked very hard.  Ballpark of 1% at pool servers.
>>>
>>> Really v1 implementations that are decades old?
>>>
>>> Or just the result of software developers that write their own NTP client,
>>> didn't look at the specs, and simply put v1 into the request packets that in
>>> fact have a v4 format?
>> 
>> A significant fraction of the NTPv1 traffic looks like this:
>> 
>>      xxxxxx.59313 > xxxxxx.ntp: NTPv1, unspecified, length 48
>> 	Leap indicator:  (0), Stratum 0 (unspecified), poll 0 (1s), precision 0
>> 	Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
>> 	  Reference Timestamp:  0.000000000
>> 	  Originator Timestamp: 0.000000000
>> 	  Receive Timestamp:    0.000000000
>> 	  Transmit Timestamp:   0.000000000
>> 	    Originator - Receive Timestamp:  0.000000000
>> 	    Originator - Transmit Timestamp: 0.000000000
>> 
>> The mode field from the future NTP versions is 0, i.e. it's a valid
>> NTPv1 request. I guess it's a result of minimizing the number of bits
>> that need to be set in the message (only one).
> 
> I still doubt that this is from a real NTPv1 implementation. Over the 
> years I have seen quite a number of customers who thought they could 
> quickly and simply write their own NTP client. I still believe this is 
> due to programmers who don't know what they are doing.

Also we had (many years ago) HP printers that sent out UDP packets to port 123 in the past, but the packets were not NTP.
Maybe someone thought 123 is a "cool" port number for private protocols...

Regards,
Ulrich