[193083] in North American Network Operators' Group
Re: Recent NTP pool traffic increase
daemon@ATHENA.MIT.EDU (Gary E. Miller)
Sat Dec 17 22:27:51 2016
X-Original-To: nanog@nanog.org
Date: Sat, 17 Dec 2016 19:25:38 -0800
From: "Gary E. Miller" <gem@rellim.com>
To: NANOG <nanog@nanog.org>
In-Reply-To: <20161217175455.30107c37@spidey.rellim.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--Sig_/k/DXhHCPQXgR8bLapqS7Jnn
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Yo All!
On Sat, 17 Dec 2016 17:54:55 -0800
"Gary E. Miller" <gem@rellim.com> wrote:
> # tcpdump -nvvi eth0 port 123 |grep "Originator - Transmit Timestamp:"
>=20
> And I do indeed get odd results. Some on my local network...
To follow up on my own post, so this can be promply laid to rest.
After some discussion at NTPsec. It seems that chronyd takes a lot
of 'creative license' with RFC 5905 (NTPv4). But it is not malicious,
just 'odd', and not new.
So, nothing see here, back to the hunt for the real cause of the new
NTP traffic.
RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
gem@rellim.com Tel:+1 541 382 8588
--Sig_/k/DXhHCPQXgR8bLapqS7Jnn
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature
-----BEGIN PGP SIGNATURE-----
iQEcBAEBCAAGBQJYVgGyAAoJEA0O2UlB0XnYWSYH/iOZuJh+iNImYIGgqy7L/cG2
iAMs5tPtV4oOBAblsOdGm4Wabxh8Nw5GjsJ7KRzscRqZ7Hmi0dtIZizZPmsna93b
BL0Ykp1K5Jn8yOabdx1Sf8QTn34+NPVC8h8Ex5fKHk6A1y8MYwDqOlDIYzin8wi8
JL5730jNjwR362SSQvgdoC8oN73tICXzaRbSxGFISgvOba+bAJRpoeGSI2ZbR0vU
e3/yoHOlK1H/VWPrlp9lGKzLMmHbQMb9L3MgKEHkijB1gx2FMae0n08JjdE2eriJ
s86bDnPmPieFvKrOFAVFTQ1ssp56dJmp+MIBJHcqq7BIkWflLsjNs8T7Qey+rwE=
=2dyA
-----END PGP SIGNATURE-----
--Sig_/k/DXhHCPQXgR8bLapqS7Jnn--
