Monitoring bad buys

Hal Murray hmurray at megapathdsl.net
Thu Sep 7 18:30:09 UTC 2017


>From issue simple mathematics (#381)
> The ntp codebase itself is not specific about what "query packets" are, but
> the processing for Mode 6 is right before that.  I'd say odds are good that
> bad guys are shipping you Mode 6 packets hoping to crack something. 

I've been thinking of tweaking the mru counters to have a separate counter 
for everything other than simple time requests.  And maybe a bit mask of 
packet types that have been seen.


-- 
These are my opinions.  I hate spam.





More information about the devel mailing list