Just for information that the Russia country zone is the latest to have collapsed apparently (based on number of active servers, yellow line), or is in the process of collapsing (based on trend of number of registered servers, red line). [Screenshot from 2024-11-15 12-20-29] See symptoms describe…

Hi @timz , welcome to the forum! [image] timz: high request rate from 3-5 IPs This can happen. Doesn’t need to be malicious, can be a misconfigured/badly programmed client, could be caused by CGNAT concentrating too many actual clients behind a single IPv4 address. [image] timz: exhaust …

[image] PoolMUC: As ISP, you might be able to more easily find out the IP addresses of the monitors, and block just those when needed. It’s easy to find addresses. You turn on “only monitoring” in the pool and collect the IPs from which the requests were made (any linux traffic accounting too…

[image] umike: Graphs looks like my own server Ah, sorry, didn’t mean to put you (or anyone else) on the spot. [image] umike: look into own query log Ah, true, forgot about that. Might be a bit of work if the server is very busy, but otherwise indeed a viable option.

[image] PoolMUC: And if you can figure out the IP addresses of the monitors as hinted at above, maybe enlisting someone else’s help with an IP address not “beleaguered” by NTP clients, you could selectively drop those if the load gets too high, minimizing impact on your actual clients. I can …

It all depends on what one wants, and how much effort to spend. In this case, I had in mind that one server was also serving direct customers of the operator, so that might be an incentive to not wholesale rate limit, but be more focused, at least exempt own customers. Those might be identifiable by…

[image] timz: The request rate from each of that IPs was high enough to exhaust conntrack connection limit of typically configured linux firewall, after which the monitor excluded the server from the pool of active servers. Step by step the monitor rearranged traffic to a new victim, amplifying…

[image] kkursor: think that he is not the only one who thought about that. Sure, I didn’t mean to say there aren’t bad actors out there. But often enough, it is just carelessness, or ignorance. And seeing that traffic seems to actually drop once the server is removed out of the pool supports …

Does anybody analyzed the traffic in the ru zone ? Is there maybe one ore more IPs which are doing a (D)DOS ? Does anybody have connections to ISP, University or any other institution who can provide some NTP Server power to the pool ?

@ PoolMUC As ISP we can do terrible things if we need. All our customers use our DNS servers. Ok. We can hijack dns zone *.pool.ntp.org and resolve these names to our ntp-server’s IPs. Any server hardware easily handle 1-2kpps for us. Customers will be happy and pool have less queries. But… DNS h…

I block nothing, but when checking…it seems that this is at a DNS level. bas@workstation:~$ nslookup ru.pool.ntp.org Server: 127.0.0.53 Address: 127.0.0.53#53 Non-authoritative answer: Name: ru.pool.ntp.org Address: 192.36.143.130 Name: ru.pool.ntp.org Address: 51.250.9.134 Name: ru.pool.ntp.org …

Collapse of Russia country zone

Server operators

kkursor November 15, 2024, 4:48pm 28

At least this guy wanted to shut down RU zone by malicious activity. I think that he is not the only one who thought about that.

Topic		Replies	Views
The issue of NTP requests exceeding bandwidth load Server operators	54	1536	November 24, 2024
Adding servers to the China zone Server operators	384	27918	June 9, 2022
List of trackers monitoring	32	725	May 21, 2025
Gradually add/remove server to/from pool in parallel to score increase/decrease Pool Development monitoring , dns	78	2987	August 22, 2024
CN pool collapse a few hours every day Server operators	47	1861	February 17, 2024

Collapse of Russia country zone

Related topics