A recent Fall from grace (dropping below 10) has brought to my attention the fact that NTP requests continue unabated and blistering despite the alleged fact that I am no longer in the pool due to my drop in score… So, how are clients still getting to my machine if they are no longer being referred to it by the pool?
A DNS request to the pool only occurs on start/restart of NTP.
As long as a client stays running it saves the IP addresses and polls the same servers until it is restarted or the server becomes unresponsive. Even then, depending on the software if they used a standard NTP distribution that has the pool directive then it will re-query and replace the unresponsive servers. If it’s using the standard server directive then it will continue to poll until it either responds or NTP is restarted.
So when you consider many of the clients are not really PCs or servers, but rather embedded devices like routers and IoT, power cycling can be few & far between…
Well that pretty much explains the continued activity… thanks