Finding abusive NTP clients

[Sanjeev Gupta]

On Fri, Apr 15, 2016 at 7:05 PM, Hal Murray <hmurray at megapathdsl.net> wrote:

> I just pushed a tweak to ntpq's mrulist command to provide more info if the
> average
> interval between requests is tiny.  Anybody running a pool server might
> like
> to try it out.
>

I am running a server in the SG pool.  Suggestions welcome.

root at ntpmon:~/ntpsec# ntpq -V
ntpd 0.9.3-e13b054 Apr 15 2016 22:07:22
root at ntpmon:~/ntpsec# clear
root at ntpmon:~/ntpsec# ntpq
ntpq> hostnames no
ntpq>  mru mincount=1000 sort=avgint
Ctrl-C will stop MRU retrieval and display partial results.
Retrieved 58 unique MRU entries and 0 updates.
lstint avgint rstr r m v  count rport remote address
==============================================================================
     0   0.01  1f0 L 3 4  32250   123 27.126.220.102
     0   0.02  1f0 L 3 4  35659   123 27.126.220.105
     0   0.02  1f0 L 3 4  35789   123 27.126.220.106
     0   0.02  1f0 L 3 4  35766   123 27.126.220.103
     0   0.02  1f0 L 3 4  35780   123 27.126.220.101
     0   0.02  1f0 L 3 4  32843   123 27.126.220.104
     1   0.51  1f0 L 3 3 2877243 18012 202.136.171.166
     0   1.14  1f0 L 3 4 1282569 54878 52.74.115.126
     1   1.71  5f0 K 1 1   1074 49332 116.87.59.232
    14   2.35  1f0 L 3 4   5761 44258 52.74.95.23
     0   2.91  1f0 L 3 4  86573 52007 58.182.99.14
     4   2.92  1f0 L 3 4 454070  7950 155.69.160.32
     2   3.14  1f0 L 3 3 159948   356 110.50.226.157
     1   3.24  1f0 L 3 4  75141 38130 116.87.179.211
     3   4.69  1f0 L 3 3 311400 59081 202.151.35.238


-- 
Sanjeev Gupta
+65 98551208     http://www.linkedin.com/in/ghane
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ntpsec.org/pipermail/devel/attachments/20160415/be09928e/attachment.html>