[193091] in North American Network Operators' Group
Re: Recent NTP pool traffic increase
daemon@ATHENA.MIT.EDU (=?utf-8?Q?Ask_Bj=C3=B8rn_Hansen?=)
Mon Dec 19 17:06:27 2016
X-Original-To: nanog@nanog.org
From: =?utf-8?Q?Ask_Bj=C3=B8rn_Hansen?= <ask@develooper.com>
In-Reply-To: <BL2PR05MB23064A7EFF95B991FFDD4AD2D09D0@BL2PR05MB2306.namprd05.prod.outlook.com>
Date: Sun, 18 Dec 2016 18:26:34 -0800
To: Jose Gerardo Perales Soto <gerardo.perales@axtel.com.mx>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
> On Dec 15, 2016, at 14:45, Jose Gerardo Perales Soto =
<gerardo.perales@axtel.com.mx> wrote:
>=20
> We've recently experienced a traffic increase on the NTP queries to =
NTP pool project (pool.ntp.org) servers. One theory is that some service =
provider NTP infraestructure failed approximately 2 days ago and traffic =
is now being redirected to servers belonging to the NTP pool project.
Hi Jose,
It=E2=80=99s more widespread than a particular service provider, so it =
seems more likely it=E2=80=99s a software update for some =E2=80=9CIoT=E2=80=
=9D device or similar.
The increase in DNS queries was on the =E2=80=9Cnon-vendor=E2=80=9D =
names, so it=E2=80=99s difficult to know who it is without being on a =
local network with one of the bad device=20
The increase in DNS queries is much smaller than the increase in NTP =
queries that are being seen, so it=E2=80=99s not just more clients, but =
badly behaving ones. :-(
https://status.ntppool.org/incidents/vps6y4mm0m69
If you have NTP servers that can be added to the pool. it=E2=80=99d be =
greatly appreciated.
http://www.pool.ntp.org/join.html
Ask
