[Pool] Taking down my NTP server in Turkey

[Fabian Wenk]

Hello Ask

On 03.08.2012 20:39, Ask Bjørn Hansen wrote:
> If we can't at some point we'll figure out to block them, but
> as long as people are willing to put up their servers to take
> the load (abuse?), then let's do that.

I am also supporting your decision to first try to talk to them 
to find out what is going on and suggesting a useful solution. 
And when I am looking at the tr zone stats [1], it looks like you 
have a lot of support to increase the number of servers for the 
tr zone. As of today, there are around 3 times more servers 
(currently 27) then 2 weeks ago.

   [1] http://www.pool.ntp.org/zone/tr

If this really are the CPEs from Turk Telekom doing this sntp 
requests, then they are probably using all the same few resolving 
DNS servers. If you have any log files on the DNS queries, then 
there is probably a way to find out which IP addresses they have. 
As far as I see it, the *.ttnet.com.tr hostnames from Turk 
Telekom are in AS9121, which has the following IP addresses [2], 
[3] assigned.

   [2] http://bgp.he.net/AS9121#_prefixes
   [3] http://bgp.he.net/AS9121#_prefixes6


bye
Fabian