Subject: Re: [Ntp] Antw: [EXT] NTP WG virtual interim -- Thursday, 17 September 2020, 1530 - 1700 UTC

From: Miroslav Lichvar <[email-masked]>
Date: Thu, 17 Sep 2020 16:50:25 +0200

On Mon, Aug 31, 2020 at 08:45:42AM +0200, Ulrich Windl wrote:
> > 4. Call for Adoption results/discussion on
> draft‑mlichvar‑ntp‑alternative‑port
> ...
> 
> I wonder: If adopted, how would it be implemented most likely? When done at
> network/transport level at some gateway:
> If incoming traffic to TDB is redirected to port 123 _if_ it's not mode 6 or
> mode 7, then the filtering could be done right on port 123. Likewise for
> outgoung traffic.

We probably don't want people to do that. The idea is that both
servers and clients are updated to support both ports. The alternative
port is used only when supported on both ends. Otherwise, it's the
same as before. No redirecting between the ports should be happening
in the network.

> Is this RFC basically for:
> 
> Inability of firewall firmware to do proper filtereing?
> Inability of network administrators to apply the correct filters ("Don't
> panic", but they still do)?

Both.

> Seeing that firewalls try deep packet inspection, I wonder whether the RFC is
> needed, specifically: How long will it take to have a significant effect? If
> you assume port 123 is blacklisted on some sites, it may be effective when all
> the NTP software had been updates, but when allowable ports are whitelisted,
> then the lack of port 123 being allowed doesn't help for the alternate port...

If only selected UDP ports are allowed in your local network, you can
ask the admin to allow it. With the global Internet you can't really
do anything. People have tried.

-- 
Miroslav Lichvar

---

From: Watson Ladd <[email-masked]>
Date: Thu, 17 Sep 2020 19:42:46 -0400

On Mon, Aug 31, 2020 at 2:46 AM Ulrich Windl
<[email-masked]> wrote:
>
> >>> Karen O'Donoghue <[email-masked]> schrieb am 28.08.2020 um 19:42 in
> Nachricht <[email-masked]>:
>
> ...

No, the goal is to get the software onto a clean port and not mess up
this time. It's a mulligan.
> then the lack of port 123 being allowed doesn't help for the alternate port...

ISP equipment often cannot inspect beyond the port number, and they
faced existential risk from the NTP floods knocking them offline.  As
a result extreme policing of port 123. Whitelisting environments are
typically ones with more control and less traffic and equipment that
can look deeper.

Sincerely,
watson