Internet2 Network Security SIG

[John Kristoff <>]

On Fri, 22 Sep 2017 14:53:24 +0000
gcbrowni 
<>
 wrote:

> 1) The first first term in the filter is a syslog that matches on
> "port 123". If it matches any tcp/udp on port 123 it syslogs and then
> next terms. I see our normal and expected NTP traffic being
> syslogged. Our final "deny" term is showing the non-authorized
> attempts to connect to us. But I DONT see anything from A.B.C.D on
> port 123.

Will your loopback filter block outgoing packets?  Probably not.  What
is in the system's ntp.conf?

> 2) I don’t think you can send NTP data to the router on any port
> other than 123. Correct?

You could, but if there is no listener... :-)  Not sure how that would
work.

> 6) Is there any reason for XNTPD to generate this message from an
> event OTHER than receiving an NTP packet through the filter. In
> response to something other than NTP? Trace, ping, a shell
> command/login? I don’t thin this can happen.

If it has A.B.C.D. as a clock source.  Perhaps there is a process on
the system that is doing something?  Is A.B.C.D. an NTP server or
client as far as you know?

John