>>To: [EMAIL PROTECTED], [EMAIL PROTECTED]
>>Message-Id: <[EMAIL PROTECTED]>
>>Subject: NTP abuse from 128.32.130.x
>>From: Jeffrey Goldberg <[EMAIL PROTECTED]>
>>Date: Mon, 16 Apr 2007 13:37:54 -0500
>>
>>
>>Hello,
>>
>>I operate one of the many pool.ntp.org NTP servers. Mine is
>>ntp0.goldmark.org. An IP on your network, 128.32.130.
>>{108,111,112,113}, is making an inordinate number of requests. It
>>has made more than 676616 requests at rates of one request every 3.5
>>seconds.
>>
>>This is a clear sign of poor NTP configuration on (or behind) that IP
>>address. Please see
>>
>> http://www.goldmark.org/netrants/ntp-abuse/
>>
>>for details.
>>
>>I strongly suspect that berkeley.edu provides high quality NTP
>>service for hosts on its network. Please make use of those.
>>
>>I have started to block NTP requests to my server from
>>128.32.130..0/24 (This won't effect other servers in pool.ntp.org
>>because, like mine, they are all run by different volunteers on
>>different parts of the network.)
>>
>>I will remove the blocking as soon as I hear that you are going to
>>look into the problem.
>
>Please feel free to block the 128.32.130.0/25 network at this point.
>I have sent email to the contacts for the 128.32.130.0/25 and the
>systems using the specific IP addresses listed above.
On of the contacts for the specific IP addresses listed above
(that is a contact for the Roulette sensors) wrote:
"Shutting down all nodes in the meantime."
but no explanation was provided concerning why all the NTP requests were
being made...
>The poorly configured systems appear to be part of the
>"Roulette" "Sensor Network Testbeds" listed on
>http://www.Millennium.Berkeley.EDU
>or http://www.millennium.berkeley.edu/sensornets/
>
>The web server for the "Roulette testbed documentation" appears
>to be down at this time.
>
>We will let you know when we know more,
>
>mark kraitchman (for [EMAIL PROTECTED])
>
>>Thank you
>>
>>-j
>>
>>
>>--
>>Jeffrey Goldberg http://www.goldmark.org/jeff/
_______________________________________________
timekeepers mailing list
[email protected]
https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
