nanog mailing list archives
Re: UDP/123 policers & status
From: Steven Sommars <stevesommarsntp () gmail com>
Date: Tue, 17 Mar 2020 17:12:17 -0500
The various NTP filters (rate limits, packet size limits) are negatively affecting the NTP Pool, the new secure NTP protocol (Network Time Security) and other clients. NTP filters were deployed several years ago to solve serious DDoS issues, I'm not second guessing those decisions. Changing the filters to instead block NTP mode 7, which cover monlist and other diagnostics, would improve NTP usability. http://www.leapsecond.com/ntp/NTP_Suitability_PTTI2020_Revised_Sommars.pdf On Tue, Mar 17, 2020 at 11:17 AM Mark Tinka <mark.tinka () seacom mu> wrote:
On 17/Mar/20 18:05, Ca By wrote: +1 , still see, still have policers Fyi, ipv6 ntp / udp tends to have a much higher success rate getting through cgn / policers / ... For those that have come in as attacks toward customers, we've "scrubbed" them where there has been interest. Mark.
Current thread:
- UDP/123 policers & status Jared Mauch (Mar 17)
- Re: UDP/123 policers & status Mark Tinka (Mar 17)
- Re: UDP/123 policers & status Compton, Rich A (Mar 17)
- Re: UDP/123 policers & status Ca By (Mar 17)
- Re: UDP/123 policers & status Mark Tinka (Mar 17)
- Re: UDP/123 policers & status Steven Sommars (Mar 18)
- Re: UDP/123 policers & status Ca By (Mar 18)
- Re: UDP/123 policers & status Saku Ytti (Mar 18)
- Re: UDP/123 policers & status Damian Menscher via NANOG (Mar 18)
- Re: UDP/123 policers & status Harlan Stenn (Mar 18)
- Re: UDP/123 policers & status Damian Menscher via NANOG (Mar 18)
- Re: UDP/123 policers & status Ca By (Mar 17)
- Re: UDP/123 policers & status Steven Sommars (Mar 19)
- <Possible follow-ups>
- Re: UDP/123 policers & status Hal Murray (Mar 23)
- Re: UDP/123 policers & status Ragnar Sundblad (Mar 27)
- Re: UDP/123 policers & status Saku Ytti (Mar 27)
- Re: UDP/123 policers & status Ragnar Sundblad (Mar 29)
- Re: UDP/123 policers & status Ragnar Sundblad (Mar 27)