Subject: [Ntp] I-D Action: draft-ietf-ntp-alternative-port-01.txt

From: [email-masked]
Date: Mon, 15 Feb 2021 07:05:13 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Network Time Protocol WG of the IETF.

        Title           : Alternative NTP port
        Author          : Miroslav Lichvar
	Filename        : draft-ietf-ntp-alternative-port-01.txt
	Pages           : 6
	Date            : 2021-02-15

Abstract:
   This document updates RFC 5905 to specify an alternative port for the
   Network Time Protocol (NTP) which is restricted to NTP messages that
   do not allow traffic amplification.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-ntp-alternative-port/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-ntp-alternative-port-01
https://datatracker.ietf.org/doc/html/draft-ietf-ntp-alternative-port-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-ntp-alternative-port-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Hal Murray <[email-masked]>
Date: Wed, 17 Feb 2021 04:01:24 -0800

Looks good.

Do we need to include rate limiting?

Without rate limiting, an NTP server can be used as a reflector.  I'm not 
plugged into the crowd that does the anti-DoS work.  How much of a problem is 
a non-amplifying reflector?

Assuming we do add rate limiting, what is a sensible limit?  Is there one?

I see two tangles:
  The first is NAT.  I have a couple of servers in the pool.  I set their rate 
limiting to 1 packet per second averaged over 20 seconds.  (you can send a 20 
packet burst)  That limit kicks in frequently with bursts of traffic that I 
think are coming from NAT boxes.  I did confirm one case.

  The second is IPv6.  Rate limiting is typically done by IP Address.  With 
IPv6, a host can have many IP Addresses.  This is really just the tip of an 
iceberg.  Even with IPv4, I can DoS a site by sending to neighboring IP 
Addresses.

-- 
These are my opinions.  I hate spam.

---

From: Miroslav Lichvar <[email-masked]>
Date: Wed, 17 Feb 2021 13:39:29 +0100

> a non-amplifying reflector?

I don't think it's a significant problem. At least I have not heard
about any attacks using a 1:1 NTP reflection. It seems there are many
other protocols (e.g. ICMP) that have this property and are not rate
limited by default.

Rate limiting is not a good security mechanism. As you point out,
attackers can avoid it by using a large number of addresses. With IPv6
there is practically an infinite number of them for the attackers to
use.

Rate limiting in NTP is a security issue on its own. It can be
exploited by attackers to deny or degrade the service to legitimate
clients of the server. I think this is a bigger issue than the
reflection.

-- 
Miroslav Lichvar