[Pool] From which IP addresses is going monitoring activity?

Chuck Swiger cswiger at mac.com
Wed Sep 21 22:23:48 UTC 2011


Hi--

On Sep 21, 2011, at 3:09 PM, Huckster wrote:
> Some results from last 24 hours:
> 
> NTP flooders activity on 21.09.2011
> 
> IP address              Received        Status
> --------------------------------------------------
> 217.112.22.131          5778            Banned
> 92.127.155.117          1902            Warning
> 91.204.179.75           411             Warning
> 93.185.151.139          406             Warning

[ ... ] 
> 89.185.66.122           110             Warning

110 queries per day is one every ~800 seconds.

That's not very different from the standard maxpoll of 10 aka every 1024 seconds.  Only the first two entries ought to qualify as potentially abusive.  The real problems aren't from someone polling every 500 seconds, or even every minute-- it's the folks sending a query every second because their config or firewall is busted.

Regards,
-- 
-Chuck



More information about the pool mailing list