Finding abusive NTP clients

[Mark Atwood]

++

On Fri, Apr 15, 2016 at 7:28 AM Sanjeev Gupta <ghane0 at gmail.com> wrote:

>
> On Fri, Apr 15, 2016 at 7:05 PM, Hal Murray <hmurray at megapathdsl.net>
> wrote:
>
>> I just pushed a tweak to ntpq's mrulist command to provide more info if
>> the
>> average
>> interval between requests is tiny.  Anybody running a pool server might
>> like
>> to try it out.
>>
>
> I am running a server in the SG pool.  Suggestions welcome.
>
> root at ntpmon:~/ntpsec# ntpq -V
> ntpd 0.9.3-e13b054 Apr 15 2016 22:07:22
> root at ntpmon:~/ntpsec# clear
> root at ntpmon:~/ntpsec# ntpq
>
> ntpq> hostnames no
> ntpq>  mru mincount=1000 sort=avgint
> Ctrl-C will stop MRU retrieval and display partial results.
> Retrieved 58 unique MRU entries and 0 updates.
>
> lstint avgint rstr r m v  count rport remote address
>
> ==============================================================================
>      0   0.01  1f0 L 3 4  32250   123 27.126.220.102
>      0   0.02  1f0 L 3 4  35659   123 27.126.220.105
>      0   0.02  1f0 L 3 4  35789   123 27.126.220.106
>      0   0.02  1f0 L 3 4  35766   123 27.126.220.103
>      0   0.02  1f0 L 3 4  35780   123 27.126.220.101
>      0   0.02  1f0 L 3 4  32843   123 27.126.220.104
>      1   0.51  1f0 L 3 3 2877243 18012 202.136.171.166
>      0   1.14  1f0 L 3 4 1282569 54878 52.74.115.126
>      1   1.71  5f0 K 1 1   1074 49332 116.87.59.232
>     14   2.35  1f0 L 3 4   5761 44258 52.74.95.23
>      0   2.91  1f0 L 3 4  86573 52007 58.182.99.14
>      4   2.92  1f0 L 3 4 454070  7950 155.69.160.32
>      2   3.14  1f0 L 3 3 159948   356 110.50.226.157
>      1   3.24  1f0 L 3 4  75141 38130 116.87.179.211
>      3   4.69  1f0 L 3 3 311400 59081 202.151.35.238
>
>
> --
> Sanjeev Gupta
> +65 98551208     http://www.linkedin.com/in/ghane
> _______________________________________________
> devel mailing list
> devel at ntpsec.org
> http://lists.ntpsec.org/mailman/listinfo/devel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ntpsec.org/pipermail/devel/attachments/20160415/3123129b/attachment.html>