[ntp:questions] Source port for NTP

MAYER Hans mayer at iiasa.ac.at
Tue Nov 3 11:59:36 UTC 2015


Hi Geoff 

> Ancillary question: can ntpd/ntpq/ntpdc be queried to confirm the  configuration file *actually* used when ntpd was invoked?

I do not understand your question completely. 
When ntpd was started it takes either the default path for ntp.conf - this is typically  /etc/ntp.conf or /etc/inet/ntp.conf 
Or ntpd was invoked with option -c
This you can verify with the ps command. 
If you want to look for the current ( running config ) you can ( and I am sure you know ) save the config with command " saveconfig" within ntpq. 
And then you can compare the running config with the startup config.

Kind regards 
Hans



-----Original Message-----
From: questions [mailto:questions-bounces+mayer=iiasa.ac.at at lists.ntp.org] On Behalf Of Geoff Down
Sent: Thursday, October 22, 2015 4:27 AM
To: questions at lists.ntp.org
Subject: [ntp:questions] Source port for NTP

Hi,
 I am occasionally getting outgoing firewall alerts from NTP attempting  to send packets back to random destinations. Although I have the latest  NTP and thus am not susceptible to NTP amplification DDoS attempts, I  would prefer not to be bugged by people scanning for vulnerable  servers. I assume that UDP packets are getting through the router due  to 'full cone NAT' as explained at https://isc.sans.edu/forums/diary/Part+2+Is+your+home+network+unwittingly+contributing+to+NTP+DDOS+attacks/18549/
and the fact that NTP is always using port 123 as the source port when it polls the remote time server every minute; thus leaving port 123 open on the router all the time, since it never times out.
 There are obviously ways to block the unwanted UDP packets after they  have reached the local network, but I'd rather they got blocked at the  router. To this end, can NTP be made to use a random source port (in  client/server mode)?
 Ancillary question: can ntpd/ntpq/ntpdc be queried to confirm the  configuration file *actually* used when ntpd was invoked?
Thanks,
Geoff Down

--
http://www.fastmail.com - mmm... Fastmail...

_______________________________________________
questions mailing list
questions at lists.ntp.org
http://lists.ntp.org/listinfo/questions


More information about the questions mailing list