Re: [Ntp] Antw: Re: Antw: Re: I-D Action: draft-ietf-ntp-port-randomization-00.txt

[Miroslav Lichvar <[e-mail]>]

On Thu, Nov 14, 2019 at 09:17:00AM +0100, Ulrich Windl wrote:
> >>> Miroslav Lichvar <[e-mail]> schrieb am 13.11.2019 um 17:00 in
> > Yes, there could be multiple clients (e.g. behind NAT), but I think we
> > can make a good guess whether any of them use a stable port by
> > counting how many requests are there per port. When I analyze 24-hour
> > captures from public servers in few different countries, for most
> > addresses there seem to be only one request per port. I'm ignoring
> > addresses that send only requests from some popular fixed ports like
> > 123, 1024, 1490.
> 
> So your result is more or less biased: What if that fixed popular ports are
> 99% of all requests? Then you are csaling up the remaining 1% to support your
> view. That's not serious argumenting.

The percentage of addresses using the fixed ports is about 10-25% in
my data. It varies between countries. But I don't think it matters
here. I'm comparing the per-association and per-request port
randomization. The fixed ports are not random.

A problem with my analysis is that it assumes most NATs preserve the
UDP port numbers at least for one client in the local network. I'm not
sure how common that really is. With NATs that always select the UDP
port randomly and clients using a polling interval longer that the NAT
timeout, it will look like the per-request randomization even if their
local port is stable. However, from the server's and Internet point of
view it doesn't matter if it's the client or NAT doing the
randomization.

> I mean this: If the client specified a specific port, the client has to make
> sure that the port isn't in use. If you specify 0 as port, the system picks a
> free one for you. Thats easier.

Even easier is to not bind the socket at all. It will be bound
automatically to a random port when the first request is sent.

-- 
Miroslav Lichvar