[ntp:questions] Curious change in traffic
dwmalone at maths.tcd.ie
Sat Mar 17 08:04:58 UTC 2007
mayer at ntp.isc.org (Danny Mayer) writes:
>Well apart from the fact that only the US changed time zone this week,
>the only way you get amplification like this is by using queries (ntpdc
>and ntpq). If you restrict queries to only your own internal network
>does it subside? Also what does ntpdc -c monlist tell you about the
>machines contacting it?
The client population on this machine is usually significantly
bigger than monlist can handle, but I'll have a look through it.
Control queries are a good call - I'll check and see if anything
unusual is going on there. I did send a copy of our monitoring
scripts to someone recently - I wonder if they forgot to change a
hostname and are running them every few seconds!
More information about the questions