Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is my NTP server costing $500 per year? Part 1 (2014)

blog.pivotal.io

Post reply on HN
Print view View original

81–90 of 113 posts

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#81

Post by ChuckMcM »

daveguy wrote: post #77
ChuckMcM wrote: post #55

I think this is great look at walking through the analysis. I too experienced a huge spike in NTP traffic in 2014 but it was because of people exploiting NTP for reflection attacks to DDOS other parties. The forced me to use a GPS module and a Beaglebone Black as an internal time server (which has been great)

I have a few questions about that if you have a minute: What GPS module did you go with and is it still available? Did you have problems getting signal inside (need to be by a window, run an antenna, etc)?

I used the Adafruit "ultimate" GPS module (https://www.adafruit.com/product/746) which has the 1pps output and can connect to an external antenna. Then I got this antenna (https://www.adafruit.com/product/960) and this adapter (https://www.adafruit.com/product/851). Soldered a header connector to Beaglebone protocape (https://www.adafruit.com/product/572), wired it to the serial port and PPS to the GPIO pin (just like this: https://web.archive.org/web/20131209092059/http://the8thlaye...).

I put the GPS antenna on my window sill, it has no problem at all staying locked. My plan had been to stick it outside the window but turned out not to be necessary.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#82

Post by _delirium »

duaneb wrote: post #66
Elrac wrote: post #12

Earlier quoted context omitted.

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic. IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

Wow, I never realized operators couldn't push fixes to their routers without permission. The internet is indeed a tragedy of the commons: trivial to ruin, but a Sisyphean task to fix.

Some operators do, mostly ISPs that lease routers to customers and retain a way to push firmware updates to them (for example, Comcast does this). But router manufacturers typically don't touch the device once it's out of their hands.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#83

Post by tyingq »

matt_wulfeck wrote: post #71
tyingq wrote: post #27

I wonder if they somehow mistakenly joined their server to the region-specific pr.pool.ntp.org group[1]. At the moment, that pool exists, but has no servers in it. So, if you were the only server in the pool, perhaps you would get a lot of Puerto Rican traffic? [1] http://www.pool.ntp.org/zone/pr

Someone else commented in the article, but it's probably related to Puerto Rico ISPs using a NAT because of lack of IPv4 address space. That single ip is probably many many people.

That one doesn't make sense to me. Most people don't have ntp configured to point to ntp.pool.org...they are mostly PC's pointed at time.windows.com. And, the pool is big enough anyway that it would spread the load from a relatively small island pretty well. NAT could be a small part of it, but there's a different primary cause.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#84

Post by matt_wulfeck »

tyingq wrote: post #83
matt_wulfeck wrote: post #71

Earlier quoted context omitted.

Someone else commented in the article, but it's probably related to Puerto Rico ISPs using a NAT because of lack of IPv4 address space. That single ip is probably many many people.

That one doesn't make sense to me. Most people don't have ntp configured to point to ntp.pool.org...they are mostly PC's pointed at time.windows.com. And, the pool is big enough anyway that it would spread the load from a relatively small island pretty well. NAT could be a small part of it, but there's a different primary cause.

It doesn't necessarily need to be Windows making the calls. Cell phones use a NAT typically and there was recently an issue with Snapchat DDoSing NATs.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#85

Post by therein »

foota wrote: post #72
feld wrote: post #70

Why are people joining VMs to the NTP pool? These servers should be identified by address space and blacklisted.

Why?

Because VMs themselves might not be able to keep track of time accurately (potentially inconsistent tickrate) the way that a bare-metal setup would be able to. That's why they should be mere consumers (as in sync their time to whatever the remote says rather than contribute to the pool).

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#86

Post by tyingq »

matt_wulfeck wrote: post #84
tyingq wrote: post #83

Earlier quoted context omitted.

That one doesn't make sense to me. Most people don't have ntp configured to point to ntp.pool.org...they are mostly PC's pointed at time.windows.com. And, the pool is big enough anyway that it would spread the load from a relatively small island pretty well. NAT could be a small part of it, but there's a different primary cause.

It doesn't necessarily need to be Windows making the calls. Cell phones use a NAT typically and there was recently an issue with Snapchat DDoSing NATs.

That's an example of a "different primary cause". It's not NAT in that case, it's an app using a library with terrible defaults.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#89

Post by technion »

I ran an NTP server on a Raspberry Pi for some time.

The bottleneck I kept hitting was the 65535 NAT translation limit on my Cisco router, at which point, load was quite manageable on the Pi.

It's extraordinary how much traffic one cheap device could service.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#90

Post by njharman »

duaneb wrote: post #66
Elrac wrote: post #12

Earlier quoted context omitted.

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic. IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

Wow, I never realized operators couldn't push fixes to their routers without permission. The internet is indeed a tragedy of the commons: trivial to ruin, but a Sisyphean task to fix.

Most admins would consider having network infrastructure's firmware change outside of their control a bug/misfeature. Not to mention most devices would require reboot to apply change.

And to be able to remotely change the code running a HUGE security issue.

Post reply on HN