Since a while, I am experiencing quite a significant number of requests from Google’s Compute Engines aka *.bc.googleusercontent.com; shouldn’t they rely on their own vendor zone, maybe even their own infrastructure?
I checked a recent packet capture and located only 93 requests from the ASN “Google”. A derisory value compared to asn requests “AMAZON-02”, which in the same 20-second period counted 15442 packets (6.4% of all ntp traffic received).
A curious fact, is that although my server is present in pool USA, it receives a huge amount of requests from Amazon servers in other countries like UK, Ireland, France…
This indicates that many Amazon servers are configured to use the US pool instead of your own country pool or the global pool.
There may be other explanation for the geographic distribution of the NTP clients you observe. For example, some geoip database is not up to date. A different reason may be that the outgoing IP address of the DNS query for pool.ntp.org domain is located in the US.
1 Like