Hi,

thank you all for the responses.

Michael, that sounds exactly as what we see.

>From the logs that we started to acquire some 10 days ago, we actually
see two different IP addresses in a case where just one is returned

132.248.30.3     (105x)
189.215.244.242 (15x)

So, we know the most probable reason for this issue. It seems to me that
this could be a problem in multiple countries as well.

May I suggest to rather return generic servers in Mexico for now? We
will use North American pool in this datacenter instead.

Regards
Jiri Horky

On 11/10/2015 07:08 AM, Michael Meier wrote:
> On 11/10/2015 01:31 AM, Mouse wrote:
>> The example you cite gives an address of 132.248.30.3.  This address is
>> actually xalli.cie.unam.mx.
>> My best guess - given the very limited information I have - is that you
>> are dealing with a provider intercepting your DNS requests and
>> returning forged responses, probably on the assumption that you are a
>> mass-market end user trying to look at Web pages.  If cie.unam.mx is
>> related to the provider you get your Mexican connectivity from, my
>> estimate of the chance that this is the explanation goes up
>> substantially.
> The estimate of the chance goes down substantially again when you
> realize that the IP returned actually is a valid ntp pool server. Would
> such an asshole-ISP actually provide a pool service? i think not.
>
> http://www.pool.ntp.org/zone/mx seems to have the answer: "There are 0
> active servers in this zone". There actually seems to be only one
> ntppool server in Mexico. And that one drops out in certain intervals,
> possibly because it gets way too much traffic.
> So what likely happens is that you get that one server while its score
> is high enough. It then drops out because it essentially gets DDoSed by
> the requests from all of Mexico. With 0 usable servers remaining in the
> .mx zone, the pool system then chooses random servers from all over the
> world. When traffic abates enough, that the one MX server answers again,
> so its score increases again, and this starts over again.

_______________________________________________
pool mailing list
[email protected]
http://lists.ntp.org/listinfo/pool

Reply via email to