| Re: [chrony-users] Rate limit question |
[ Thread Index |
Date Index
| More chrony.tuxfamily.org/chrony-users Archives
]
- To: chrony-users@xxxxxxxxxxxxxxxxxxxx
- Subject: Re: [chrony-users] Rate limit question
- From: Miroslav Lichvar <mlichvar@xxxxxxxxxx>
- Date: Wed, 22 Sep 2021 17:46:11 +0200
- Authentication-results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=mlichvar@xxxxxxxxxx
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1632325577; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=1mR5NaraE2F1NSEG0aFutilK5NVOx3iH4LewtqRfcDM=; b=d2w1EWmtUgzFN4jWTNwFPBZC5JOmSuTB2ThWmClPpdDTzXpc4K4DXKGlOPVOOCpf5szYB9 w49cZnt7YMAuklwgg3xw48JdmWhxOGlkH06ezJUWelnEWIYhA9cuSPKaNjwvIBlNmq8Cbg g5HnyR64QJhKHuZIm2clER3TFBqIvbo=
On Wed, Sep 22, 2021 at 08:09:47AM -0500, Steven Sommars wrote:
> Running chrony 4.1-pre1. chrony.conf has a ratelimit directive
> ratelimit interval 4 burst 4
> When a large burst (thousands of requests) from one IP arrives, I expect at
> most 4 packets to be sent in one interval (2^4=16 seconds). Instead I see
> 1 response per 4 requests on average.
>
> Where did I go wrong?
That is expected behavior. See the leak option of the ratelimit
directive in the chrony.conf man page.
chronyd cannot just stop responding to an address if it appears to be
sending too many requests. We don't know if it is not an attacker
sending requests with a spoofed source address trying to deny the
service to a legitimate client. IIRC we have discussed this on the NTP
WG list.
The purpose of rate limiting is to save some traffic on broken or
misconfigured clients. If you don't respond at all, you save 50% of
the incoming+outgoing traffic. If you respond to 1/4 of requests, you
save only 37.5%, but still allow the client to synchronize in case it
is under an attack.
--
Miroslav Lichvar
--
To unsubscribe email chrony-users-request@xxxxxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject.
For help email chrony-users-request@xxxxxxxxxxxxxxxxxxxx
with "help" in the subject.
Trouble? Email listmaster@xxxxxxxxxxxxxxxxxxxx.