>To: [EMAIL PROTECTED], [EMAIL PROTECTED]
>Message-Id: <[EMAIL PROTECTED]>
>Subject: NTP abuse from 128.32.130.x
>From: Jeffrey Goldberg <[EMAIL PROTECTED]>
>Date: Mon, 16 Apr 2007 13:37:54 -0500
>
>
>Hello,
>
>I operate one of the many pool.ntp.org NTP servers. Mine is
>ntp0.goldmark.org. An IP on your network, 128.32.130.
>{108,111,112,113}, is making an inordinate number of requests. It
>has made more than 676616 requests at rates of one request every 3.5
>seconds.
>
>This is a clear sign of poor NTP configuration on (or behind) that IP
>address. Please see
>
> http://www.goldmark.org/netrants/ntp-abuse/
>
>for details.
>
>I strongly suspect that berkeley.edu provides high quality NTP
>service for hosts on its network. Please make use of those.
>
>I have started to block NTP requests to my server from
>128.32.130..0/24 (This won't effect other servers in pool.ntp.org
>because, like mine, they are all run by different volunteers on
>different parts of the network.)
>
>I will remove the blocking as soon as I hear that you are going to
>look into the problem.
Please feel free to block the 128.32.130.0/25 network at this point.
I have sent email to the contacts for the 128.32.130.0/25 and the
systems using the specific IP addresses listed above.
The poorly configured systems appear to be part of the
"Roulette" "Sensor Network Testbeds" listed on
http://www.Millennium.Berkeley.EDU
or http://www.millennium.berkeley.edu/sensornets/
The web server for the "Roulette testbed documentation" appears
to be down at this time.
We will let you know when we know more,
mark kraitchman (for [EMAIL PROTECTED])
>Thank you
>
>-j
>
>
>--
>Jeffrey Goldberg http://www.goldmark.org/jeff/
_______________________________________________
timekeepers mailing list
[email protected]
https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
