Re: Finding abusive NTP clients

2016-12-01 Thread Sanjeev Gupta
On Thu, Dec 1, 2016 at 12:28 PM, Matthew Selsky wrote: > Sanjeev, > > I implemented command shortcuts per https://gitlab.com/NTPsec/ > ntpsec/issues/171 > > Classic ntpq allowed every command to be shorten, as long as it was unique. > > ntpsec ntpq now has that. >

Re: Finding abusive NTP clients

2016-11-19 Thread Hal Murray
> Hal, the 'mru' command no longer works. Was this removed intentionally? It's probably blocked by some restrictions (to avoid DDoS). Another possibility is that your fingers typed the old name for a similar command. I forget what it was called. The (new) mrulist command requires a cookie

Re: Finding abusive NTP clients

2016-11-19 Thread Sanjeev Gupta
On Fri, Apr 15, 2016 at 7:05 PM, Hal Murray wrote: > > I just pushed a tweak to ntpq's mrulist command to provide more info if > the > average > interval between requests is tiny. Anybody running a pool server might > like > to try it out. > > It now looks like this: >

Re: Finding abusive NTP clients

2016-04-16 Thread Gary E. Miller
Yo Hal! On Sat, 16 Apr 2016 12:46:13 -0700 Hal Murray wrote: > > 1 0.51 1f0 L 3 3 2877243 18012 202.136.171.166 > > 0 1.14 1f0 L 3 4 1282569 54878 52.74.115.126 > > Wow! The bottom two take the record. If I read that right, they > have been

Re: Finding abusive NTP clients

2016-04-16 Thread Hal Murray
gha...@gmail.com said: > lstint avgint rstr r m v count rport remote address > == > 0 0.01 1f0 L 3 4 32250 123 27.126.220.102 > 0 0.02 1f0 L 3 4 35659 123 27.126.220.105 > 0 0.02 1f0 L 3 4