3 ms·
[author] > I wish he'd explained somewhere how they leapt to examining virtualized NTP clients... I had a hunch [wrongly] that the traffic was caused by a par
by brian_cunnie 10y ago
[author]
> I wish he'd explained somewhere how they leapt to examining virtualized NTP clients...
I had a hunch [wrongly] that the traffic was caused by a particular operating system. I didn't have enough machines to run the tests on bare-metal, so I virtualized them. And I suspected that virtualization would provide a worst-case scenario (the virtualized clocks would be jittery).
My big surprise was that Windows was a model client (once per day), OS X was good, too, and that FreeBSD was the worst and Ubuntu a close second. It was a complete inversion of what I had expected to find.
> what they ultimately did (since there's no part 3 that I can find).
I never wrote part 3, but now that it seems the post has gained traction on Hacker News I might be inspired to write one. The summary would be as follows:
To reduce your costs by a quarter, use the following lines in your NTP configuration file to throttle overly-aggressive clients (the important directive is `limited`:
```
restrict default limited kod nomodify notrap nopeer
discard minimum 0
```
Here is a description of NTP rate-limiting and why `limited`, `kod`, and `discard` are important: https://www.eecis.udel.edu/~mills/ntp/html/rate.html https://www.eecis.udel.edu/~mills/ntp/html/rate.html
Here is my current NTP configuration:
https://github.com/cunnie/deployments/blob/95e9c71e882d453ec0fd168f3a8030ea0707c05a/concourse-ntp-pdns-gce.yml#L178-L192 https://github.com/cunnie/deployments/blob/95e9c71e882d453ec...
- dfc 10y agoI have never understood why people think kod is a useful setting. Why do you think a misbehaving/improperly configured client is going to honor the kod packet? The kod packet helps with some clients but I have never seen it change the behavior of the most egregious abusers. Just ignore future requests from misbehaving clients, there is not a lot of benefit in saying "please stop misbehaving" to a client that does not follow the spec. Your configuration is lacking a number two big best practices. The most glaring is that you really need to add 'iburst' to your server stanzas. After that you should think about adjust minsane and minclock.
- AstroJetson 10y agoCan you post a few more lines about this? I'm in the process of standing up a server and would like to know more about controlling the load. Thanks!
- jlgaddis 10y agoIf an NTP client is already misbehaving and/or misconfigured to the point where it's considered "abusive", what are the chances the client will do The Right Thing(TM) when it receives a "kiss of death" ("kod") packet from the NTP server? Enable KOD, by all means, but you may also consider putting in some (high) per-IP rate limiting for 123/UDP in your firewall rules as a backup plan (for if/when clients ignore kod).
- rincebrain 10y agoIt's not strictly harmful, I think, to presume that some percentage of misbehaving clients might just be misconfigured and honor a KoD, as long as you have other measures, unless I'm overlooking something?
- dfc 10y agoI never said it was harmful.