[ntp:questions] Curious change in traffic

Danny Mayer mayer at ntp.isc.org
Sat Mar 17 19:15:53 UTC 2007


David Malone wrote:
> mayer at ntp.isc.org (Danny Mayer) writes:
> 
>> Well apart from the fact that only the US changed time zone this week,
>> the only way you get amplification like this is by using queries (ntpdc
>> and ntpq). If you restrict queries to only your own internal network
>> does it subside? Also what does ntpdc -c monlist tell you about the
>> machines contacting it?
> 
> The client population on this machine is usually significantly
> bigger than monlist can handle, but I'll have a look through it.
> Control queries are a good call - I'll check and see if anything
> unusual is going on there. I did send a copy of our monitoring
> scripts to someone recently - I wonder if they forgot to change a
> hostname and are running them every few seconds!
> 
> 	David.

You should also consider upgrading it. It's running 4.1.0 which is
pretty old. I also couldn't get a monlist out of it. I was getting bad
responses from it with ntpdc.

Danny



More information about the questions mailing list