I noticed now many customers using tp-links reported issues with internet connection. Analyzing internet traffic, i noticed that tp-link seems excessively requesting ntp from those ip addresses, and not trying others:
192.5.41.40.123: NTPv3, Client, length 48 192.5.41.41.123: NTPv3, Client, length 48 133.100.9.2.123: NTPv3, Client, length 48
I'm asking customer to make photo of device, to retrieve model and revision, and checking other customers as well, if they are abusing same servers. On 2016-12-19 20:33, Ca By wrote:
My WAG is that the one plus updated firmeware on that day and they baked in the pool.
Complete WAG, but time and distributed sources including wireless networks
On Mon, Dec 19, 2016 at 10:30 AM Laurent Dumont <admin@coldnorthadmin.com> wrote:
I also have a similar experience with an increased load.
I'm running a pretty basic Linode VPS and I had to fine tune a few
things in order to deal with the increased traffic. I can clearly see a
date around the 14-15 where my traffic increases to 3-4 times the usual
amounts.
I did a quick dump and in 60 seconds I was hit by slightly over 190K IPs
http://i.imgur.com/mygYINk.png
Weird stuff
Laurent
On 12/17/2016 10:25 PM, Gary E. Miller wrote:
Yo All!
On Sat, 17 Dec 2016 17:54:55 -0800
"Gary E. Miller" <gem@rellim.com> wrote:
# tcpdump -nvvi eth0 port 123 |grep "Originator - Transmit Timestamp:"
And I do indeed get odd results. Some on my local network...
To follow up on my own post, so this can be promply laid to rest.
After some discussion at NTPsec. It seems that chronyd takes a lot
of 'creative license' with RFC 5905 (NTPv4). But it is not malicious,
just 'odd', and not new.
So, nothing see here, back to the hunt for the real cause of the new
NTP traffic.
RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
gem@rellim.com Tel:+1 541 382 8588