Excessive DNS queries for NTP pool addresses
forum.flightradar24.com
Excessive DNS queries for NTP pool addresses
1–10 of 31 posts
Re: Excessive DNS queries for NTP pool addresses
#2[deleted]
Re: Excessive DNS queries for NTP pool addresses
#3Later in the thread:
> I looked at it in some more detail a few hours after I posted this and it looks like this isn't a "normal" feature of the FR24 client but rather a failure to handle DNS problems gracefully. An issue with a local DNS server meant it was returning "domain not found" for some domains, including the *.pool.ntp.org domains.
> It seems the FR24 client has embedded calls to system programs to would find the first working (i.e successful ping) NTP host, sync up time from there and then carry on, but in this case as each host fails it tries the next in the list and when the list is exhausted it starts again from the top. Thus firing off an endless stream of DNS queries at a high rate until it manages to connect to an NTP server. The ICMP traffic wasn't actually generated in this case as the ping command fails because in my specific case the host address couldn't be found, for NTP servers that are in the pool but block ICMP this would generate traffic but still fail a ping.
> The local DNS problem turned out to be a misbehaving Pi-Hole installation on my home network refusing some DNS queries but it would be nice to see some kind of backoff algorithm or delay in the client, or preferably just insist on a working NTP client on the feeder rather than forced NTP syncs via external commands and a liberal use of ping.
Seems like the title is misleading.
Re: Excessive DNS queries for NTP pool addresses
#4Later in the thread: > I looked at it in some more detail a few hours after I posted this and it looks like this isn't a "normal" feature of the FR24 client but rather a failure to handle DNS problems gracefully. An issue with a local DNS server meant it was returning "domain not found" for some domains, including the *.pool.ntp.org domains. > It seems the FR24 client has embedded calls to system programs to would fi…
It seems not, because, even later:
"fr24feed appears to be doing 12 NTP queries direct to servers around the world every ten minutes, which is about three times as much load as the pool recommends and appears to be a very high load on the parts of the world where there are few volunteers running NTP servers"
https://forum.flightradar24.com/threads/11042-Excessive-DNS-...
Re: Excessive DNS queries for NTP pool addresses
#5Later in the thread: > I looked at it in some more detail a few hours after I posted this and it looks like this isn't a "normal" feature of the FR24 client but rather a failure to handle DNS problems gracefully. An issue with a local DNS server meant it was returning "domain not found" for some domains, including the *.pool.ntp.org domains. > It seems the FR24 client has embedded calls to system programs to would fi…
Keep reading. They hammer hardcoded NTP servers constantly, as opposed to abiding by the pool guidelines
Re: Excessive DNS queries for NTP pool addresses
#6The NTP Pool has very simple guidelines for vendors distributing software with hard-coded NTP server names. Very simply, they ask that you set up a vendor DNS alias. Details here: http://www.pool.ntp.org/en/vendors.html#basic-guidelines
The NTP Pool is an incredibly valuable public resource. It's run by volunteers, all they ask is you treat the resource with respect so it works for everyone.
Re: Excessive DNS queries for NTP pool addresses
#7Later in the thread: > I looked at it in some more detail a few hours after I posted this and it looks like this isn't a "normal" feature of the FR24 client but rather a failure to handle DNS problems gracefully. An issue with a local DNS server meant it was returning "domain not found" for some domains, including the *.pool.ntp.org domains. > It seems the FR24 client has embedded calls to system programs to would fi…
It seems not, because, even later: "fr24feed appears to be doing 12 NTP queries direct to servers around the world every ten minutes, which is about three times as much load as the pool recommends and appears to be a very high load on the parts of the world where there are few volunteers running NTP servers" https://forum.flightradar24.com/threads/11042-Excessive-DNS-...
While 1.2 vs 0.4 requests per minute is indeed a factor of three, calling it "abuse" instead of something like "misconfigured" or "misuse" seems overblown.
What are you going to call the initial report of thousands of requests per second then?
Re: Excessive DNS queries for NTP pool addresses
#8The NTP Pool has very simple guidelines for vendors distributing software with hard-coded NTP server names. Very simply, they ask that you set up a vendor DNS alias. Details here: http://www.pool.ntp.org/en/vendors.html#basic-guidelines The NTP Pool is an incredibly valuable public resource. It's run by volunteers, all they ask is you treat the resource with respect so it works for everyone.
It's really amazing that we've seen so many of the issues in the past. If you use standard tools in the standard way, you're not going to create any floods. It baffles me that vendors are re-inventing the wheel and generating NTP floods.
Re: Excessive DNS queries for NTP pool addresses
#9The NTP Pool has very simple guidelines for vendors distributing software with hard-coded NTP server names. Very simply, they ask that you set up a vendor DNS alias. Details here: http://www.pool.ntp.org/en/vendors.html#basic-guidelines The NTP Pool is an incredibly valuable public resource. It's run by volunteers, all they ask is you treat the resource with respect so it works for everyone.
It's really amazing that we've seen so many of the issues in the past. If you use standard tools in the standard way, you're not going to create any floods. It baffles me that vendors are re-inventing the wheel and generating NTP floods.
I can't help feel that we have gotten a generation of programmers and whatsnot that has no respect for existing tools. Rather than try to grok what is already out there they will instead grab whatever is the hyped language of the day and roll their own.
Re: Excessive DNS queries for NTP pool addresses
#10Earlier quoted context omitted.
It's really amazing that we've seen so many of the issues in the past. If you use standard tools in the standard way, you're not going to create any floods. It baffles me that vendors are re-inventing the wheel and generating NTP floods.
I can't help feel that we have gotten a generation of programmers and whatsnot that has no respect for existing tools. Rather than try to grok what is already out there they will instead grab whatever is the hyped language of the day and roll their own.
You're just describing inexperienced but somewhat technically competent developers. I was also like that at the beginning of my career. Most of the programmers go through this way. I guess the difference these days is that the ratio of people at the beginning of their careers to the seasoned developers is way higher and they are being assigned more and more critical tasks as demand goes through the roof.