How are N people / devices getting time from your server from behind a CGNAT worse than N people / devices getting time from your server with separate IP addresses? The only difference I see is the out dated idea of having to rate limit addresses that poll servers at a higher rate than what a single device would do. I cannot see how many devices behind a single IP address equal abuse.
CGNAT breaks the IP end to end standard. Too bad, but not my problem. My problem is keeping my resources healthy.
But that’s a lot of hand wringing for nothing, since most clients query multiple servers, when being blocked by one won’t make a difference.
Thank you for the education. I’m still fine with my settings, as 10 packets every 2 seconds is certainly enough, and does not harm anyone unless it’s carrier NAT, then…it probably still works for many. Some basic rate limiting always slows down abuse. And I think this is the absolute, most basic of rate limits. AND IT STILL LIMITS RESPONSES. I’m not worried about my rates, I’m worried that NTP is so often used as a way to mask an attack source. In the pool or not, public NTP servers are absolutely used to relay dDoS attacks, and should have some very basic rate limiting.
I’m liberal in what I accept and I’m conservative in what I send. This is EXACTLY how this rate limit works! If everyone did this, and had these same very very basic rate limits, NTP would stop being used as a traffic relay to mask the attacker.
Attacker spoofs Target IP address, and sends requests to all the NTP servers it can find. (Most of the time, attacker is a large bot net, of machines that are on internet without ingress filtering) Those NTP servers reply and the Target IP gets the replies. Anyone doing packet tracing never finds the actual real source of the attack. As someone who has dealt with dDoS, I want to never help anyone participate in a dDoS.
And while no one wants to admit it, NTP is about the first thing anyone doing a dDoS mitigation blocks, because it’s used so widely.
16:25:59 up 10 days, 3:08,
NTP packets received : 274104377
NTP packets dropped : 24647773
Dividing the smaller by the larger is .0899 or about 9%. I’m making a difference, and I’m not even using conservative rate limits. Also, none of the servers, esp this one, have been listed in the pool for several weeks.
When do you get this is (still) possible?
Aren’t you confused with DNS-dDos-attacks?
That happened in the past.
As well as (open-)proxy attacks.
We did have KoD, but that has been solved a long time ago.
Please tell us how you (or others) can make a dDOS happen via an (updated) NTP-server.
Do we have evidence of that? Because I suspect a lot of cheap devices running sntp based on cronjobs. You can see it in the stats. Every half an our a DNS peak. That doesn’t scale well when sitting behing CGNAT with many others.
Therefore; when will the NTP pool add AAAA to the remaining three DNS names?
Isn’t it four? The main one without the digits in front, pool.ntp.org and then with 0,1 and 3 added.
I explained it in the paragraph above the paragraph you quoted. Please read it again. Blocking port 123 is in the default configuration of any carrier grade dDoS mitigation filter. More than a decade ago it was the first filter they’d add in the dDoS mitigation training due to the old multiplication problem, and it persists today. It’s no longer a traffic multiplier, but it still can be a traffic source trace-back obfuscator. The ICMP service unavailable packet from a udp 123 query is actually an obfuscator AND traffic multiplier and can do the same thing when aimed at ANY host on the internet NOT running an ntp server, except that most providers rate limit most ICMP most of the time so those attacks are less likely to ever succeed.
There are other ways to complicate the tracking of spoofed reply traffic, NTP is not special. NTP is just one of the many multiple choices that an attacker can use to obfuscate traffic. The idea is that with enough very basic rate limits (10 per second, per client) in enough NTP Pool servers, eventually attackers will go pick another attack vector and leave the NTP folks alone. It works everywhere if everyone does it, but it helps everywhere if anyone does it.
Eventually, addresses expire and have to be resolved again by DNS.
Nevertheless, I don’t care how many innocent bystanders in a crappy ISP abusing CGNAT are hurt by one bad actor alongside them. My priority is keeping my resources healthy to serve all the other innocent bystanders in decent ISPs.
Given the average time to respond to issues, not in our lifetimes.
No it is not. Where do you get this info?
Hi @jpasker
I read your post the other day and have been thinking about it since then.
Your comments -“I’m worried that NTP is so often used as a way to mask an attack source. In the pool or not, public NTP servers are absolutely used to relay dDoS attacks,”, “NTP would stop being used as a traffic relay to mask the attacker.” and “And while no one wants to admit it, NTP is about the first thing anyone doing a dDoS mitigation blocks, because it’s used so widely”.
From thses comments it sounds like NTP servers are used each and every day to relay attacks. I have had multiple NTP servers around the world for multiple years and can not say I have seen, without doubt, that a particular traffic pattern was caused by someone using my server in a DDOS attack.
I have no doubt that both “good” and “bad” requests are being processed by my servers but I have not seen what your comments seem to imply that the attacks are a constant and ongoing occurance.
I have servers in Asia and constantly see thousands of requests from ip addresses but how do I, as a server operator, know that these requests are part of a DDOS attack or just some faulty firmware in a product. Is there something I can do, some linux command, to show to me that these requests are part of a DDOS or just a software bug?
Interested in your thoughts and any supporting evidence you may have to show NTP servers are constantly being used in ongoing DDOS attacks.
I monitor my servers very close. And I have never found any evidence they are/can be used to create DDOS attacks.
As far as I’m aware you can only do this when you spoof the IP-address of the package.
To do that the UDP-package itself must be manipulated, containing the sender-IP.
You could do that, but every NTP-server has a ratelimiter, so in order to send a massive DDOS via NTP, you need thousand of servers to attack 1 IP.
Most allow you to send a burst of about 6 packets, even with 1000 NTP-servers, you only manage to send 6000 packets to 1 IP in a short time.
That will not be much of an DDOS as you can’t even maintain it. And those packets only ‘attack’ port 123, this will get you nowhere.
You need a bit more then that to bring a system down 
NTP is useless for this purpose in my opinion.