6 ms·

Excessive DNS queries for NTP pool addresses

78 points by efftee 9y ago

deleted 9y ago
[deleted]
SiempreViernes 9y ago
Later in the thread: > I looked at it in some more detail a few hours after I posted this and it looks like this isn't a "normal" feature of the FR24 client but rather a failure to handle DNS problems gracefully. An issue with a local DNS server meant it was returning "domain not found" for some domains, including the *.pool.ntp.org domains. > It seems the FR24 client has embedded calls to system programs to would find the first working (i.e successful ping) NTP host, sync up time from there and then carry on, but in this case as each host fails it tries the next in the list and when the list is exhausted it starts again from the top. Thus firing off an endless stream of DNS queries at a high rate until it manages to connect to an NTP server. The ICMP traffic wasn't actually generated in this case as the ping command fails because in my specific case the host address couldn't be found, for NTP servers that are in the pool but block ICMP this would generate traffic but still fail a ping. > The local DNS problem turned out to be a misbehaving Pi-Hole installation on my home network refusing some DNS queries but it would be nice to see some kind of backoff algorithm or delay in the client, or preferably just insist on a working NTP client on the feeder rather than forced NTP syncs via external commands and a liberal use of ping. Seems like the title is misleading.
- mdekkers 9y ago
  Keep reading. They hammer hardcoded NTP servers constantly, as opposed to abiding by the pool guidelines
- acqq 9y ago
  It seems not, because, even later: "fr24feed appears to be doing 12 NTP queries direct to servers around the world every ten minutes, which is about three times as much load as the pool recommends and appears to be a very high load on the parts of the world where there are few volunteers running NTP servers" https://forum.flightradar24.com/threads/11042-Excessive-DNS-queries-for-NTP-pool-addresses?s=9c2a36a984a38ff32360f8f3d10efc28&p=101240&viewfull=1#post101240 https://forum.flightradar24.com/threads/11042-Excessive-DNS-...
  - SiempreViernes 9y ago
    While 1.2 vs 0.4 requests per minute is indeed a factor of three, calling it "abuse" instead of something like "misconfigured" or "misuse" seems overblown. What are you going to call the initial report of thousands of requests per second then?
    - eropple 9y ago
      It's not overblown to characterize something about a system you are told not to do "abuse". If it is misuse, it is abuse. Words mean things.
      - freehunter 9y ago
        Words do in fact mean things, and that's why there's so many of them. Abuse and misuse are two similar words with distinct connotations. Abusing something means it's intentional and is causing significant harm. Misusing something means using it in a way that could be accidental or intentional, but is contrary to the way the thing should be used. I have to agree with the other person, unless this was done intentionally and the programmer knew it would cause damage, calling it abuse sounds overly dramatic. I think the word misuse is far more accurate here.
        eropple 9y ago
        Send an email to misuse@example.com and explain the problem and I'm sure someone will get right on it. Wait--you mean to tell me it's abuse@ for a reason...?
        deleted 9y ago
        [deleted]
        Brian_K_White 9y ago
        The second they said "we're not fixing that" it became conscious deliberate inconsiderate abuse. That was a typical and awful response to that bug report. The original poster essentially pointed out some bad engineering. "it works for most people" is an utter crap response to that.
NelsonMinar 9y ago
The NTP Pool has very simple guidelines for vendors distributing software with hard-coded NTP server names. Very simply, they ask that you set up a vendor DNS alias. Details here: http://www.pool.ntp.org/en/vendors.html#basic-guidelines http://www.pool.ntp.org/en/vendors.html#basic-guidelines The NTP Pool is an incredibly valuable public resource. It's run by volunteers, all they ask is you treat the resource with respect so it works for everyone.
- chrissnell 9y ago
  It's really amazing that we've seen so many of the issues in the past. If you use standard tools in the standard way, you're not going to create any floods. It baffles me that vendors are re-inventing the wheel and generating NTP floods.
  - digi_owl 9y ago
    I can't help feel that we have gotten a generation of programmers and whatsnot that has no respect for existing tools. Rather than try to grok what is already out there they will instead grab whatever is the hyped language of the day and roll their own.
    - egeozcan 9y ago
      You're just describing inexperienced but somewhat technically competent developers. I was also like that at the beginning of my career. Most of the programmers go through this way. I guess the difference these days is that the ratio of people at the beginning of their careers to the seasoned developers is way higher and they are being assigned more and more critical tasks as demand goes through the roof.
      - digi_owl 9y ago
        And if you tell them that they are barking up the wrong tree, they run to social media to get you labeled as a "hater"...
- 9y ago
reaperducer 9y ago
I used to love FL24, until it stopped supporting its Mac client which I paid for, rendering it useless. All you get is a message asking you to subscribe to the program you've already paid for.
- glup 9y ago
  What did the desktop client have that the web interface doesn't? Would love an OS X client personally.
  - reaperducer 9y ago
    Primarily speed. Secondarily, the ability to display full-screen across a 27-inch display.
jimrandomh 9y ago
This sounds like a bug (or maybe two bugs), not the result of any sort of policy decision. So, before taking a combative stance and trying to shame them into fixing it, it's important to make sure the relevant information has actually reached the person who actually could fix it, and they've had some time to work!
- sundvor 9y ago
  The first post in that thread was made 2017-05-03.
  - jimrandomh 9y ago
    Okay, but did it actually get read by the right person? It's very easy for bug reports that came in the form of forum posts to slip by unnoticed. Or noticed by tech support people who don't realize it might be worth escalating to dev.

78 points by efftee 9y ago

deleted 9y ago

[deleted]

Later in the thread: > I looked at it in some more detail a few hours after I posted this and it looks like this isn't a "normal" feature of the FR24 client but rather a failure to handle DNS problems gracefully. An issue with a local DNS server meant it was returning "domain not found" for some domains, including the *.pool.ntp.org domains. > It seems the FR24 client has embedded calls to system programs to would find the first working (i.e successful ping) NTP host, sync up time from there and then carry on, but in this case as each host fails it tries the next in the list and when the list is exhausted it starts again from the top. Thus firing off an endless stream of DNS queries at a high rate until it manages to connect to an NTP server. The ICMP traffic wasn't actually generated in this case as the ping command fails because in my specific case the host address couldn't be found, for NTP servers that are in the pool but block ICMP this would generate traffic but still fail a ping. > The local DNS problem turned out to be a misbehaving Pi-Hole installation on my home network refusing some DNS queries but it would be nice to see some kind of backoff algorithm or delay in the client, or preferably just insist on a working NTP client on the feeder rather than forced NTP syncs via external commands and a liberal use of ping. Seems like the title is misleading.

mdekkers 9y ago
Keep reading. They hammer hardcoded NTP servers constantly, as opposed to abiding by the pool guidelines
acqq 9y ago
It seems not, because, even later: "fr24feed appears to be doing 12 NTP queries direct to servers around the world every ten minutes, which is about three times as much load as the pool recommends and appears to be a very high load on the parts of the world where there are few volunteers running NTP servers" https://forum.flightradar24.com/threads/11042-Excessive-DNS-queries-for-NTP-pool-addresses?s=9c2a36a984a38ff32360f8f3d10efc28&p=101240&viewfull=1#post101240 https://forum.flightradar24.com/threads/11042-Excessive-DNS-...
- SiempreViernes 9y ago
  While 1.2 vs 0.4 requests per minute is indeed a factor of three, calling it "abuse" instead of something like "misconfigured" or "misuse" seems overblown. What are you going to call the initial report of thousands of requests per second then?
  - eropple 9y ago
    It's not overblown to characterize something about a system you are told not to do "abuse". If it is misuse, it is abuse. Words mean things.
    - freehunter 9y ago
      Words do in fact mean things, and that's why there's so many of them. Abuse and misuse are two similar words with distinct connotations. Abusing something means it's intentional and is causing significant harm. Misusing something means using it in a way that could be accidental or intentional, but is contrary to the way the thing should be used. I have to agree with the other person, unless this was done intentionally and the programmer knew it would cause damage, calling it abuse sounds overly dramatic. I think the word misuse is far more accurate here.
      - eropple 9y ago
        Send an email to misuse@example.com and explain the problem and I'm sure someone will get right on it. Wait--you mean to tell me it's abuse@ for a reason...?
        deleted 9y ago
        [deleted]
      - Brian_K_White 9y ago
        The second they said "we're not fixing that" it became conscious deliberate inconsiderate abuse. That was a typical and awful response to that bug report. The original poster essentially pointed out some bad engineering. "it works for most people" is an utter crap response to that.

NelsonMinar 9y ago

The NTP Pool has very simple guidelines for vendors distributing software with hard-coded NTP server names. Very simply, they ask that you set up a vendor DNS alias. Details here: http://www.pool.ntp.org/en/vendors.html#basic-guidelines http://www.pool.ntp.org/en/vendors.html#basic-guidelines The NTP Pool is an incredibly valuable public resource. It's run by volunteers, all they ask is you treat the resource with respect so it works for everyone.

chrissnell 9y ago
It's really amazing that we've seen so many of the issues in the past. If you use standard tools in the standard way, you're not going to create any floods. It baffles me that vendors are re-inventing the wheel and generating NTP floods.
- digi_owl 9y ago
  I can't help feel that we have gotten a generation of programmers and whatsnot that has no respect for existing tools. Rather than try to grok what is already out there they will instead grab whatever is the hyped language of the day and roll their own.
  - egeozcan 9y ago
    You're just describing inexperienced but somewhat technically competent developers. I was also like that at the beginning of my career. Most of the programmers go through this way. I guess the difference these days is that the ratio of people at the beginning of their careers to the seasoned developers is way higher and they are being assigned more and more critical tasks as demand goes through the roof.
    - digi_owl 9y ago
      And if you tell them that they are barking up the wrong tree, they run to social media to get you labeled as a "hater"...
9y ago

reaperducer 9y ago

I used to love FL24, until it stopped supporting its Mac client which I paid for, rendering it useless. All you get is a message asking you to subscribe to the program you've already paid for.

glup 9y ago
What did the desktop client have that the web interface doesn't? Would love an OS X client personally.
- reaperducer 9y ago
  Primarily speed. Secondarily, the ability to display full-screen across a 27-inch display.

jimrandomh 9y ago

This sounds like a bug (or maybe two bugs), not the result of any sort of policy decision. So, before taking a combative stance and trying to shame them into fixing it, it's important to make sure the relevant information has actually reached the person who actually could fix it, and they've had some time to work!

sundvor 9y ago
The first post in that thread was made 2017-05-03.
- jimrandomh 9y ago
  Okay, but did it actually get read by the right person? It's very easy for bug reports that came in the form of forum posts to slip by unnoticed. Or noticed by tech support people who don't realize it might be worth escalating to dev.