# Software and devices without a vendor zone **URL:** \ **Category:** Uncategorized\ **Created:** [December 20, 2016, 9:05am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28 "2016-12-20T09:05:16Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jan-philipp.benecke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/jan-philipp.benecke/32/8_2.png) [@jan-philipp.benecke](https://community.ntppool.org/u/jan-philipp.benecke)\ **Post date:** [December 20, 2016, 9:05am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/1 "2016-12-20T09:05:16Z")
Found an other project with hardcoded [pool.ntp.org](http://pool.ntp.org) zone names. > Created already a [issue](https://github.com/huynguyencong/NHNetworkTime/issues/21) ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [December 21, 2016, 12:34am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/2 "2016-12-21T00:34:00Z")
Yeah, there are way too many of these. Last I looked about 60% of DNS queries were for the “non-vendor” DNS names, and I suspect a higher proportion of the NTP queries (since someone signing up for a vendor zone hopefully reads more documentation and looks at their implementation a little more carefully). Anyone “spotting” others, please leave a note here. It’s quite a lot of work to get it changed for each vendor, but having a list might both create a little attention to the issue and for another “incident” in the future it might make it quicker to figure out who it is. ---
**Author:** ![gfk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/gfk/32/1479_2.png) [@gfk](https://community.ntppool.org/u/gfk)\ **Post date:** [December 21, 2016, 4:20pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/3 "2016-12-21T16:20:12Z")
I did a Google search for: > “[pool.ntp.org](http://pool.ntp.org)” include return filetype:c and was able to spot many in a few minutes: - [https://github.com/marvell-iot/aws\_starter\_sdk/blob/master/sample\_apps/net\_demo/ntpc\_demo/src/main.c](https://github.com/marvell-iot/aws_starter_sdk/blob/master/sample_apps/net_demo/ntpc_demo/src/main.c) - [https://github.com/espressif/esp-idf/blob/master/examples/06\_sntp/main/sntp\_main.c](https://github.com/espressif/esp-idf/blob/master/examples/06_sntp/main/sntp_main.c) - [https://www-users.cs.york.ac.uk/~pcc/Circuits/mbed/baseboard/code/sntp.c](https://www-users.cs.york.ac.uk/~pcc/Circuits/mbed/baseboard/code/sntp.c) - [http://on6ll.be/PIC-WEB%205.42/Microchip/TCPIP%20Stack/SNTP.c](http://on6ll.be/PIC-WEB%205.42/Microchip/TCPIP%20Stack/SNTP.c) - [ntp.c in src/router/rc – DD-WRT](http://svn.dd-wrt.com/browser/src/router/rc/ntp.c?rev=24462) - [sntp.c in UsbWattMeter/trunk/lwip-1.4.1/apps/sntp – Contributed Software](https://dev.toppers.jp/trac_user/contrib/browser/UsbWattMeter/trunk/lwip-1.4.1/apps/sntp/sntp.c?rev=167) But I wonder, do we really want to have a vendor for every piece of software that uses the pool? It doesn’t seem realistic… In any case, I think that we should get in touch with DD-WRT, this is a popular piece of software. ---
**Author:** ![gfk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/gfk/32/1479_2.png) [@gfk](https://community.ntppool.org/u/gfk)\ **Post date:** [December 21, 2016, 4:40pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/4 "2016-12-21T16:40:29Z")
I reported the issue with DD-WRT: [https://www.dd-wrt.com/dd-wrtv2/bugtracker/view.php?id=4813](https://www.dd-wrt.com/dd-wrtv2/bugtracker/view.php?id=4813) ---
**Author:** ![gfk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/gfk/32/1479_2.png) [@gfk](https://community.ntppool.org/u/gfk)\ **Post date:** [December 22, 2016, 2:55am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/5 "2016-12-22T02:55:12Z")
I contacted Zentyal about their use of [pool.ntp.org](http://pool.ntp.org): [https://wiki.zentyal.org/wiki/En/3.5/Time\_synchronization\_service\_(NTP)](https://wiki.zentyal.org/wiki/En/3.5/Time_synchronization_service_(NTP)) ---
**Author:** ![gfk](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/gfk/32/1479_2.png) [@gfk](https://community.ntppool.org/u/gfk)\ **Post date:** [December 22, 2016, 3:05am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/6 "2016-12-22T03:05:32Z")
Created an [issue](https://github.com/adafruit/Adafruit_CC3000_Library/issues/155) with Adafruit for their [CC3000 Lib](https://github.com/adafruit/Adafruit_CC3000_Library/blob/master/examples/InternetTime/InternetTime.ino) but they’re likely using the pool in many of their projects. ---
**Author:** ![johnpoz](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@johnpoz](https://community.ntppool.org/u/johnpoz)\ **Post date:** [January 2, 2017, 11:03am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/7 "2017-01-02T11:03:50Z")
So you would like a report of devices that are not using a vendor specific fqdn for ntp pool? If so I can tell you for sure the hs110 smart plug from tp-link is doing queries for just regional ntp pool… And what drives me nuts is EU based or UK specific - and I am using their product in the US. My current log shows it looking for [uk.pool.ntp.org](http://uk.pool.ntp.org) I redirect this to my local ntp… I don’t have access to is source, but just from logging its dns I can see who its asking for… ---
**Author:** ![jan-philipp.benecke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/jan-philipp.benecke/32/8_2.png) [@jan-philipp.benecke](https://community.ntppool.org/u/jan-philipp.benecke)\ **Post date:** [January 2, 2017, 1:41pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/8 "2017-01-02T13:41:34Z")
I’m going to contact TP-Link and ask for a technical contact. Hopefully we could notify them about that issue. Has someone a router of TP-Link and could verify that there is the same issue ? Additionaly i’m going to contact AVM. They use [0.europe.pool.ntp.org](http://0.europe.pool.ntp.org) as default. ---
**Author:** ![jan-philipp.benecke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/jan-philipp.benecke/32/8_2.png) [@jan-philipp.benecke](https://community.ntppool.org/u/jan-philipp.benecke)\ **Post date:** [January 2, 2017, 2:42pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/9 "2017-01-02T14:42:00Z")
Answer from AVM: The issue was forwarded to the corresponding product owner. ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [January 2, 2017, 9:00pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/10 "2017-01-02T21:00:59Z")
> [@johnpoz](#): > > So you would like a report of devices that are not using a vendor specific fqdn for ntp pool? Yes. I’m not really sure how much it’ll help, but I think it’s worth a try. In particular if others (like Jan-Philipp, thank you!) are up for politely trying to inform the vendors. ---
**Author:** ![johnpoz](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@johnpoz](https://community.ntppool.org/u/johnpoz)\ **Post date:** [January 3, 2017, 11:20am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/11 "2017-01-03T11:20:56Z")
Well they make 100’s of thousands of products that are deployed in not millions… All over the world with tp-link… So having them use the correct ntp should at min keep them in their region right 😉 hehehe I think is a great idea and will keep an eye out for any other sort of mischief… ---
**Author:** ![jan-philipp.benecke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/jan-philipp.benecke/32/8_2.png) [@jan-philipp.benecke](https://community.ntppool.org/u/jan-philipp.benecke)\ **Post date:** [January 3, 2017, 11:48am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/12 "2017-01-03T11:48:42Z")
I wrote TP-Link. I waiting for a reply 🙂 ---
**Author:** ![hnapel](https://avatars.discourse-cdn.com/v4/letter/h/47e85d/32.png) [@hnapel](https://community.ntppool.org/u/hnapel)\ **Post date:** [January 3, 2017, 8:17pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/13 "2017-01-03T20:17:19Z")
hi guys, I analyzed an issue that sprang from a forum question on the Flightradar24 website, it appears the fr24feed program that is typically run on raspberry PI’s has a bunch of hardcoded pool servers in them from all over the planet. > **[FR24feed on Raspberry Pi - Frequent DNS requests for NTP -...](https://forum.flightradar24.com/forum/radar-forums/flightradar24-feeding-data-to-flightradar24/10363-fr24feed-on-raspberry-pi-frequent-dns-requests-for-ntp?10611-FR24feed-on-Raspberry-Pi-Frequent-DNS-requests-for-NTP=#post105895)** > > All about feeding data to Flightradar24 (The Flightradar24 receiver, Raspberry Pi and Windows feeding software). No discussions about Flightradar24 web or apps. Maybe your unique leverage can bring them to sanity… greetings, Harm ---
**Author:** ![josephb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/josephb/32/7_2.png) [@josephb](https://community.ntppool.org/u/josephb)\ **Post date:** [January 4, 2017, 3:18am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/14 "2017-01-04T03:18:52Z")
> [@hnapel](#): > > it appears the fr24feed program that is typically run on raspberry PI’s I’d guess less than 10k systems deployment worldwide? It’s a niche hobby area, not saying we shouldn’t encourage them to use the pool properly but it’s likely there are a lot bigger abusive systems out there. It also shows that a lot of the work to find systems abusing the pool will need to be done by DNS analysis. ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [January 4, 2017, 5:50am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/15 "2017-01-04T05:50:21Z")
It’s not to discourage them, but to help make them use the pool correctly. If they have their own hostname we have a (vague) chance of diagnosing what’s going on if their use goes haywire and it gives us a moment to have an educational opportunity explaining a bit about how to use the pool (for example not using 1.{every-continent}.pool.ntp.org many times an hour/day/whatever like the FR24Feed thing apparently does). ---
**Author:** ![josephb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/josephb/32/7_2.png) [@josephb](https://community.ntppool.org/u/josephb)\ **Post date:** [January 5, 2017, 12:26am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/16 "2017-01-05T00:26:57Z")
> [@ask](#): > > If they have their own hostname we have a (vague) chance of diagnosing what’s going on if their use goes haywire Good points 🙂 ---
**Author:** ![jan-philipp.benecke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/jan-philipp.benecke/32/8_2.png) [@jan-philipp.benecke](https://community.ntppool.org/u/jan-philipp.benecke)\ **Post date:** [January 5, 2017, 2:23pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/17 "2017-01-05T14:23:52Z")
Reply from TP-Link: > Thank you for your feedback. Could you possibly set up a “vendor zone” for this? @ask: Could you setup one and send it to me ? Or must they do that ? ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [January 5, 2017, 6:09pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/18 "2017-01-05T18:09:09Z")
Great, thank you. They should do it so they can fill out the forms for contact information etc. ---
**Author:** ![jan-philipp.benecke](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/jan-philipp.benecke/32/8_2.png) [@jan-philipp.benecke](https://community.ntppool.org/u/jan-philipp.benecke)\ **Post date:** [January 5, 2017, 6:19pm UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/19 "2017-01-05T18:19:14Z")
Ok, thanks. A minute ago i saw that my NAS (Synology) also use the pool as default without vendor zone. I mailed Synology ---
**Author:** ![elljay](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@elljay](https://community.ntppool.org/u/elljay)\ **Post date:** [January 10, 2017, 10:16am UTC](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28/20 "2017-01-10T10:16:08Z")
I’d independently contacted Flightradar24 about their usage based on the thread @hnapel mentioned. I’ve just had a reply from them saying their client does do those lookups but they will review. I’ve pointed them in the direction of the Vendor page and copied you in @ask (hope that was ok!). [Next page](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28.md?page=2)