Beta - bad scores

Server operators
5

Here’s what happened, based on the the two tcpdumps. I’ll list the Newark side below, times are UTC

  1. NTP monitor sent one request
    2020-05-20 20:00:05.453937 139.178.64.43 -> 92.240.244.202 NTP 90 NTP Version 4, client

  2. That request was duplicated in the IP network between the monitor and your NTP server (more below).
    There are now two requests en route to your server. Both requests have the same NTP “Transmit time stamp.”

  3. First response arrives and NTP server responds:
    2020-05-20 20:00:05.555389 92.240.244.202 -> 139.178.64.43 NTP 90 NTP Version 4, server

  4. NTP pool monitor software closes UDP port 35085

  5. Second request arrives and NTP server responds
    2020-05-20 20:00:05.557512 92.240.244.202 -> 139.178.64.43 NTP 90 NTP Version 4, server

  6. Since the NTP Pool monitor has closed the port the incoming packet is rejected:
    2020-05-20 20:00:05.557535 139.178.64.43 -> 92.240.244.202 ICMP 118 Destination unreachable (Port unreachable)
    It might be easier to see this by comparing tcpdumps; that’s why I requested a sample pcap from your side.

I have some extra NTP probes running now, so this would be a great time to collect the tcpdump.

Tentatively I’ve identified the duplicates as originating from “Lightstorm”; I’m unfamiliar with this ISP.

Steve Sommars