I'm seeing this at a rate of about 500 packets/second:
17:24:13.850413 IP 31.134.29.9.ntp > 80.69.163.42.ntp: NTPv3, symmetric active, length 48 17:24:13.852698 IP 31.134.29.9.ntp > 80.69.163.42.ntp: NTPv3, symmetric active, length 48 17:24:13.854897 IP 31.134.29.9.ntp > 80.69.163.42.ntp: NTPv3, symmetric active, length 48 17:24:13.856563 IP 31.134.29.9.ntp > 80.69.163.42.ntp: NTPv3, symmetric active, length 48
I don't know if the source address has been spoofed or if they just think sending NTP packets at that rate is somehow fun.
The "limited kod" restrict configuration (as kindly suggested by Dave Hart) works wonderfully in this situation, so my server is not having problems handling this traffic.
This has been going on for a while now, and it'll probably stop immediately after I've sent this message. See my NTP traffic graphs http://leopardi.miuku.net/stats/ntppackets.html
_______________________________________________ pool mailing list [email protected] http://lists.ntp.org/listinfo/pool
