# Suspicious DNS replies on 0.centos.pool.ntp.org query

**URL:** <https://community.ntppool.org/t/suspicious-dns-replies-on-0-centos-pool-ntp-org-query/1588>\
**Category:** Uncategorized\
**Created:** [February 13, 2020, 2:47pm UTC](https://community.ntppool.org/t/suspicious-dns-replies-on-0-centos-pool-ntp-org-query/1588 "2020-02-13T14:47:13Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Bas](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/bas/32/465_2.png) [@Bas](https://community.ntppool.org/u/Bas)\
**Post date:** [February 13, 2020, 3:01pm UTC](https://community.ntppool.org/t/suspicious-dns-replies-on-0-centos-pool-ntp-org-query/1588/4 "2020-02-13T15:01:33Z")

</div>

I understand that F-secure etc will trigger on it.  
Just tell them that port 123 shouldn’t be checked for source.  
Then it won’t trigger anything.

And if you are worried over an attack, then change the trigger to e.g. 10 times a minute on same ip.  
As an NTP-client doesn’t come that often.

To me it looks like false positives.

---

_[View the full topic](https://community.ntppool.org/t/suspicious-dns-replies-on-0-centos-pool-ntp-org-query/1588)._