[ntp:questions] Curious change in traffic

David Malone dwmalone at maths.tcd.ie
Sat Mar 17 08:04:58 UTC 2007


mayer at ntp.isc.org (Danny Mayer) writes:

>Well apart from the fact that only the US changed time zone this week,
>the only way you get amplification like this is by using queries (ntpdc
>and ntpq). If you restrict queries to only your own internal network
>does it subside? Also what does ntpdc -c monlist tell you about the
>machines contacting it?

The client population on this machine is usually significantly
bigger than monlist can handle, but I'll have a look through it.
Control queries are a good call - I'll check and see if anything
unusual is going on there. I did send a copy of our monitoring
scripts to someone recently - I wonder if they forgot to change a
hostname and are running them every few seconds!

	David.




More information about the questions mailing list