undefined | Better HN

0 pointsscurvy9y ago0 comments

Blocking UDP 123 upstream is a common tactic to avoid participating in NTP DDoS botnets.

You're best off running your own NTP infrastructure that's isolated from the public Internet NTP servers if you want stable time sources. Put a CDMA NTP server in two locations, let them sync, and go. You can get cheap EndRun servers on eBay for a few hundred bucks.

0 comments

2 comments · 1 top-level

xorcist9y ago· 1 in thread

It's tempting to believe telecom has got their act together, but I've found the public Internet NTP infrastructure to be more stable than CDMA/GSM refclocks. YMMV.

scurvyOP9y ago

It's why you need multiple sources. The NTP protocol and implementation handles sudden skews from a source. When done properly, CDMA clocks can offer a much more stable source than the public internet, and you can filter out UDP 123 upstream.

j / k navigate · click thread line to collapse