3 ms·
Blocking UDP 123 upstream is a common tactic to avoid participating in NTP DDoS botnets. You're best off running your own NTP infrastructure that's isolated fr
by scurvy 10y ago
Blocking UDP 123 upstream is a common tactic to avoid participating in NTP DDoS botnets.
You're best off running your own NTP infrastructure that's isolated from the public Internet NTP servers if you want stable time sources. Put a CDMA NTP server in two locations, let them sync, and go. You can get cheap EndRun servers on eBay for a few hundred bucks.
- xorcist 10y agoIt's tempting to believe telecom has got their act together, but I've found the public Internet NTP infrastructure to be more stable than CDMA/GSM refclocks. YMMV.
- scurvy 10y agoIt's why you need multiple sources. The NTP protocol and implementation handles sudden skews from a source. When done properly, CDMA clocks can offer a much more stable source than the public internet, and you can filter out UDP 123 upstream.