Talk:NTP server misuse and abuse

message: I'm confused at how the PHK / D-Link case was "amicably resolved".  From a technical point of view, it seems that simply not worrying any more about the existing misuse / abuse is going to cause the bandwidth consumption problem to continue indefinitely.  At the very least, I would think they should have agreed to reassign the gps.dix.dk host name to a new IP address (possibly an address belonging to D-Link) — so all that traffic wouldn't keep on getting sent to Denmark — and then given PHK's server a new name, and spread the word about the new host name to the users in Denmark.  But as far as I can tell from doing traceroute gps.dix.dk just now, the machine is still in Denmark somewhere.  Does anyone know any more technical details of how this case was "resolved" (and why they didn't do something like what I just described)?  Richwales 02:48, 29 June 2006 (UTC)
thread_title:  Technical details of "amicable resolution"? 

message: The Tardis and Trinity College, Dublin is confusing if you just read our description. Reading the sources, it's clear this didn't really involve a NTP server but a HTTP server which used to function an NTP server as well. Tardis implemented an option to get time via HTTP servers in case firewalls blocked NTP servers but didn't do it very well. For example, they only included 4 total HTTP servers and allowed users to set the update interval to 1 minute and also used a GET rather then a HEAD request increasing the amount of data transferred and didn't include a user agent so admins had no way of knowing what was making the requests. Anyway for this reason I'm not sure if it belongs (unless we rename it to time server rather then NTP server as per the request above) but if it does, it needs to be clarified since as it stands, it's confusing (what the heck does HTTP have to do with NTP?) Nil Einne (talk) 12:53, 11 May 2011 (UTC)
thread_title:  Tardis and Trinity College, Dublin 

message: :"One particularly common software error is to generate query packets at short (less than five second) intervals until a response is received."
I have seen IPs sending more than 30 packets within one second to my NTP server for more than ten minutes. Is this still the described software error or is it already some sort of a DOS attack? What is a reasonable limit (e.g. connections per IP per minute/second) for a firewall to keep within NTP specifications? Even RFC 1305 seems to be not really helpful - at least I couldn't find an answer there. --Liberal Freemason (talk) 16:05, 26 June 2011 (UTC)
thread_title:  Software error or DOS attack? 

message: Hello fellow Wikipedians,
I have just modified  on NTP server misuse and abuse. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20060423012837/http://people.freebsd.org/~phk/dlink/ to http://people.freebsd.org/~phk/dlink/
*Added archive https://web.archive.org/web/20060423012837/http://people.freebsd.org/~phk/dlink/ to http://people.freebsd.org/~phk/dlink/
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—cyberbot IITalk to my owner:Online 05:09, 2 July 2016 (UTC)
thread_title:  External links modified