Subject: [Ntp] NTP version 1 requests

From: Hal Murray <[email-masked]>
Date: Mon, 22 Jun 2020 11:03:17 -0700

I have a couple of servers in the pool.  They get version 1 requests.

Does anybody know what software package and/or OS/distro they are coming from?

0.25% in San Francisco
0.025% in London

-- 
These are my opinions.  I hate spam.

---

From: Paul Gear <[email-masked]>
Date: Tue, 23 Jun 2020 19:14:23 +1000

I took a sample of traffic coming into my pool servers over a 2-hour
period.  I've only done some very basic analysis, but I see between
about 0.6% and 2.1% of NTP traffic is v1.

I looked at some of the differences between received packets (mode &
root dispersion are the most obvious), and looked up a few IPs in
Shodan, and I'd say there are at least 2 or 3 different implementations
involved.

One looks to be a particular Cisco model often used for IPsec VPNs,
probably supplied by TPG Internet (or one of the companies it bought
out) here in Australia, and another appears to be an embedded platform
used by an ISP in the Philippines.  (The population is probably skewed,
since my servers are in the AU & Oceania pools.)

I don't have a paid Shodan account, so I can't do a full analysis, but
I'm happy to share the packet captures if someone else has better tools
for reconnaissance on the IPs.

Regards,
Paul