Need suggestions on dealing with SNTP clients running on cron jobs

Server operators
1

I have an IPv4 NTP server running in the pool for several months now, and it has been quite a problem for me that it seems there are large amount of clients which run some sort of synchronization script on a fixed absolute time and interval (every 15 minutes, specifically 0, 15, 30, 45 minute of each hour), which causes load spikes to the server and also triggers cloud provider’s DDoS protection to kick in (see below).

image
image1280×600 51.1 KB

The servers are running in CN zone, and I’m just curious about how other people deal with this kind of clients and is this specific for CN zone or global.

EDIT 1: These spikes would have been higher without ISP’s DDoS services. I have recorded >200Mbps (200kpps) traffic on DDoS dashboard when the bandwidth is configured to 1.5Mbps on management portal.

image
image1434×972 83 KB

2

Yes, it does happen globally. More in some countries, less in others. Such configuration is against the pool’s terms of service, but there’s little we server operators can do about these problematic configurations.

The way I dealt with this was to tell the ISP that my server is in the NTP pool and such traffic spikes to UDP/123 are expected. They raised the DDoS alert threshold for my server and the ISP’s DDoS countermeasures no longer kicked in.