Finding abusive NTP clients

[Hal Murray]

I just pushed a tweak to ntpq's mrulist command to provide more info if the 
average
interval between requests is tiny.  Anybody running a pool server might like 
to try it out.

It now looks like this:

ntpq> hostnames no
ntpq> mru mincount=1000 sort=avgint
Ctrl-C will stop MRU retrieval and display partial results.
Retrieved 239 unique MRU entries and 0 updates.
lstint avgint rstr r m v  count rport remote address
==============================================================================
 35374   0.03  190 . 3 4   5046 44762 64.72.56.95
   670   0.04  190 . 3 4   4148 38778 162.243.188.66
 57962   0.06  190 . 3 4   1345 33523 96.41.112.161
 90455   0.07  190 . 3 3   1877 49488 2601:644:500:e800:a9d6:8245:1f95:b31b
 66199   0.07  190 . 3 3   2081 54645 159.191.174.119
 47234   0.07  190 . 3 3   1084 40403 108.227.128.23
 62845   0.08  190 . 3 3   1956 47876 71.95.206.54
 19026   0.08  190 . 3 1   3931 63329 190.14.219.238
   460   0.08  190 . 3 4   1877 56897 72.130.39.211
 40670   0.08  190 . 3 3   1629 42184 98.203.248.229
 90375   0.09  190 . 3 4   1185 38002 24.56.50.247
 60720   0.09  190 . 3 3   1599 65462 216.100.91.14
 16506   0.09  190 . 3 3   1026 57813 75.172.167.145
  7633   0.09  190 . 3 3   1557 37974 67.1.146.70
 58813   0.10  190 . 3 1   3134  2410 73.179.193.171
  5947   0.10  190 . 3 3   1171 52276 104.32.81.108
 90798   0.11  190 . 3 4   1388 34042 198.199.99.66
...




-- 
These are my opinions.  I hate spam.