Skip to Content.
Sympa Menu

netsec-sig - Re: [Security-WG] I2 - Strange xntpd behavior

Subject: Internet2 Network Security SIG

List archive

Re: [Security-WG] I2 - Strange xntpd behavior


Chronological Thread 
  • From: John Kristoff <>
  • To: gcbrowni <>
  • Cc: "" <>
  • Subject: Re: [Security-WG] I2 - Strange xntpd behavior
  • Date: Fri, 22 Sep 2017 10:56:32 -0500
  • Ironport-phdr: 9a23:48B/mhG+3x2qpwjXCGJ0VJ1GYnF86YWxBRYc798ds5kLTJ7zpcWwAkXT6L1XgUPTWs2DsrQf2rqQ6/iocFdDyK7JiGoFfp1IWk1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZrKeTpAI7SiNm82/yv95HJbQhFgDmwbaluIBmqsA7cqtQYjYx+J6gr1xDHuGFIe+NYxWNpIVKcgRPx7dqu8ZBg7ipdpesv+9ZPXqvmcas4S6dYDCk9PGAu+MLrrxjDQhCR6XYaT24bjwBHAwnB7BH9Q5fxri73vfdz1SWGIcH7S60/VDK/5KlpVRDokj8KOTA5/m/Jl8J+j6BUoBy7pxNw34Hab5qYNOZnfq7HYd8WWXZNU8RXWidcAo28dYwPD+8ZMOhcqIn9p10Opga7Cwm2BePv0SNIhnj43a00zu8sFgPG3BAjH98VrXvbss31O70PUeCx1qXH0yjMb+5P1Dr79YPGcQghrOmSUb9xb8bd1UwiGx/Ag1mOt4DoPy+Z2+ETv2SG8uZtVeeihHI7pw5roDWiw9ogh4rHho8Vz13L7jl2z5woKdC9U0F0e9qpHIVWuiqHLYV5WNkiTHttuCsiyr0Jp5q7fC8SxZs9xx7QceaHc5CS7hLiU+aROyt3iGh4d72hnxa961WgyunmWsaqzVlKszJJktjKtn8Tyxze8taLR/pj8ku93DuDywXe5v9aLU00iabWLoAtzqMtmpcTtEnMAjP6l1/0gaKTa0kp+eao5uTib7r9upCTLZJ4hwTlPas0nsGzH/w0Mg0UUGia/eS82qfj/Ur8QLhSjP02jqrZvYvHKssFvq62GRJV0oI55xmhEjimzcwUnWMbI1JdZBKHk4/pNknVIP/mEfi/nk6skDZ3x/HGJ7HgDJrNI2PHkLfgZrZ991VcxBQpwdBe4ZJUFq8OIOj1WkDvqNzUEAU1PBKpzOb6W51B0dYRUmiVBbCfMeuGvlSC/OUwJeika4sSsj/5Lf8uof/zy3I1hAlOR6Sx2YorbyW6AvdOKkWQe2Kqg9AbGiEGsxI3UeishVGfAhBJYHPnfaU84HkYEoO9EYDNSMj5gqCC9Cu2BpRLYiZLBk3aQiSgTJmNR/pZMHHaGcRmiDFRDbU=

On Fri, 22 Sep 2017 15:50:01 +0000
gcbrowni
<>
wrote:

> ntp.conf is as expected with just out NTP server in it, we don’t do
> outbound RE filters, and I don’t think A.B.C.D is an NTP server. I
> THINK this is somehow scanning related. I think.

Some Junos systems will listen internally on 128.0.0.[1|4] I've
noticed. I'm not sure what the point of this is, but a wag might be
something related to that?

Another wag might be a tunneled or fragmented packet to your router,
which gets past a filter?

Let us know when you figure it out. :-)

John



Archive powered by MHonArc 2.6.19.

Top of Page