[time] ICMP pings and ntp

der Mouse mouse
Fri Dec 4 12:22:23 UTC 2009


> I noticed to my ntp server in the pool, craploads of icmp requests
> per second (about 1/50th the amount of ntp requests).

> Most of these send several icmp requests every so often, then an ntp
> request.

I just checked mine.

I took a 1000-packet snapshot (turned out to be about 42 seconds).  8
ICMP packets (half ECHO_REQUEST to me, half ECHO_RESPONSE from me); 659
port-123 packets, presumably all NTP (358 to me, 301 from me - some of
the hosts I block for abusive levels of traffic keep hammering on the
block).

The four pings were sent by four different hosts, none of which
appeared elsewhere in the capture at all.

I then took a 10000-packet snapshot.  6066 port-123 packets and no ICMP
at all.  (The other 3934 packets are unrelated traffic; my pool host is
also my house router, and as such sees tunnel traffic to/from external
parts of my house network.  My capture excluded forwarded traffic, but
the tunnels' outer traffic still showed up.)

So, I guess I'm not seeing what you are. :)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse at rodents-montreal.org
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B



More information about the pool mailing list