Another NTP client failure story

[mnordhoff]

@littlejason99

Right now I have a branch of Cisco that makes IoT thingies that appears to be pounding my NTP server with requests from a very specific netblock. When you log it based on IP they stick out like a sore thumb, but compared to the overall amount of requests it’s not worth getting in a huge battle over. I’ve tried contacting them with no luck… Every now and then I block that netblock hoping someone will raise an eyebrow and wonder, but maybe they went one step further and hard-coded multiple IPs or something… Queries don’t let up even when blocked, so definitely hard-coded and definitely not a well behaved client.

Jasper Technologies and 204.156.180.0/22?

I don’t think they’ve hardcoded anyone’s IPs – I think they’re doing normal DNS lookups and slamming the entire Pool that hard.

My hope(?) is that they actually have like a billion devices behind a small NAT block.