This is sounding like an innocuous ntp survey: http://alumni.media.mit.edu/~nelson/research/ntp-survey99/ http://www.ntpsurvey.arauc.br/ http://www.eecis.udel.edu/~mills/database/reports/ntp-survey99-minar.pdf
Planetlab nodes have been used for such ntp surveys in the past: http://lists.planet-lab.org/pipermail/devel/2007-June/001937.html http://www.eecs.umich.edu/~zmao/Papers/pam08_owd.pdf ________________________________________ From: [email protected] [[email protected]] On Behalf Of Rob Janssen [[email protected]] Sent: Saturday, December 10, 2011 10:55 AM To: [email protected] Subject: Re: [Pool] Odd surge in traffic today I checked the monlist of a system that used to be in the pool long ago, when it had a different IP address for the same domain name, and I found several systems in there that have names with "planetlab" in it, from all over the world. Not sure if they have been running a portscan from there, or if they may have picked the info from the pool long ago. Does anyone else with a rarely used server see that traffic? (I presume for those that run a pool server it has been removed from the list by regular traffic) It also appears that some users have resolved the IP address the system had when it was in the pool back to a domain name, and entered that name into their ntp.conf so that when my system changed address and left the pool, they still followed it. Rob _______________________________________________ pool mailing list [email protected] http://lists.ntp.org/listinfo/pool _______________________________________________ pool mailing list [email protected] http://lists.ntp.org/listinfo/pool
