Hi all, I have changed my servers to drop clients that do not behave. 2 parameters I set in Chrony and I see lots of abusive clients drop like flies. ratelimit interval 6 burst 6 clientloglimit 4194304 There is no reason why people should poll loads of times, some even ten times a second from th…

[image] zeroav: Unless it is a IPv4 and involves a CGNAT pool ? Perhaps it would not be unreasonable for the NTP Pool project to declare a queries/IP/second that should be supported by a pool volunteer and then everything after that is accepted to be at risk of being dropped? As IPv4 depleti…

[image] Badeand: So, the root of the issue must be fixed by people who are likely blissfully unaware of it. Should the owners of offending IP addresses systematically be contacted and informed through the abuse email address found in whois? Or how do we raise the issue with the right people? N…

[image] Bas: Many ISP’s, Cloud-providers and others are symply lazy I suspect it has never occurred to them that this problem exists, that all the clients behind the same DNS cache will hit the same 4 servers, and they probably never paid attention to how much bandwidth they’re consuming with…

[image] grifferz: Maybe it is acceptable to say that large CGNAT populations can’t be accomodated and should query using IPv6? I like the idea, but it seems to me the pool needs to first start returning IPv6 addresses for all DNS queries. As it is, only queries to 2.*.pool.ntp.org return IPv…

[image] grifferz: Can we brainstorm ways that pool volunteers can more quickly temporarily remove themselves out of the pool when they get overwhelmed? That exists, they can lower their configured bit rate to “Monitoring only”. There’s undoubtedly a way to automate this, but I don’t know how…

Hostname NTP Drop Int IntL Last Cmd Drop Int Last ============================================================================================ 2001:e68:5e28:3a00:215:5dff:fe9a:7b00 4632 3016 …

[image] davehart: That exists, they can lower their configured bit rate to “Monitoring only” Is this sufficient? It’s my perception (haven’t checked) that resolvers are sometimes caching for longer than the pool’s TTL and broken clients are holding onto resolved pool IPs, so it is hard to per…

[image] grifferz: broken clients are holding onto resolved pool IPs I think there is a misunderstanding here. Actually, that is how “full” NTP clients are supposed to operate. Note the remark on the “Join the pool” page : because of how the ntp clients operate it will take weeks, months or e…

To add to this: Once a server does not get regular pool traffic anymore, it should be able to handle whatever residual traffic still arrives. I once “removed” one of my servers from the pool for maintenance with the “Monitoring only” option, and traffic went down by ~80% after just a couple of minut…

Some client really can't behave

Server operators

PoolMUC December 16, 2023, 10:06pm 31

Just to connect some dots, the topic, and the challenge involved in realizing something like an API for this, have been discussed in this thread.

Topic		Replies	Views
The issue of NTP requests exceeding bandwidth load Server operators	54	1711	November 24, 2024
Howto deal with bad NTP-Client / Attacker? Server operators	50	2302	December 1, 2023
What is a reasonable limit? Uncategorized	64	5903	December 27, 2022
No PR action for project and dramatic reduction in the number of active servers Uncategorized	60	3118	January 7, 2020
I take a big hit in queries Server operators	111	1785	December 15, 2025

Some client really can't behave

Related topics