Discussion:
[ntp:questions] D-link and hardcoded ntp servers
Simon Lyall
2006-04-08 01:14:29 UTC
Permalink
See:

http://people.freebsd.org/~phk/dlink/

I notice that most of the servers that are hardcoded in are from the
public list but many of the have access limits.
--
Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/
"Inside me Im Screaming, Nobody pays any attention." | eMT.

` Microsoft/Fisher-Price "My First Operating System" windows machines
(equipped, no doubt, with chewable mice, bright colours, and E-Z-Kleen
keyboards) stay _completely_ off the core network segments. ' - JSR
Maarten Wiltink
2006-04-08 15:13:09 UTC
Permalink
"Simon Lyall" <simon at darkmere.gen.nz> wrote in message
Post by Simon Lyall
http://people.freebsd.org/~phk/dlink/
Way to go, D-Link. I'll think twice about buying any of your products.
Poul-Henning, you have my sympathy.

Donating money sounds nice but if it paid the DIX fees, it would end
up subsidising D-Link for being idiots. Damned if you do, damned if
you don't.

Groetjes,
Maarten Wiltink
Wolfgang S. Rupprecht
2006-04-08 16:25:31 UTC
Permalink
Post by Simon Lyall
http://people.freebsd.org/~phk/dlink/
I'm reminded of Yogi Berra's quote: It's like deja vu, all over again.
Post by Simon Lyall
I notice that most of the servers that are hardcoded in are from the
public list but many of the have access limits.
I just replaced the firmware on my Linksys WRT54G router with Openwrt
and one benefit is that it doesn't hardwire any ntp servers. The one
annoying thing about the embedded linux that everyone is using on
their routes is that it doesn't have any hooks for tweaking the kernel
clock frequency. The clock seems to be free-running and one can only
step it. Well, I guess I shouldn't criticize the dancing bear's
dancing. It is pretty amazing to have what appears to be a fairly
featureful linux in a $50 device that takes half a dozen watts at
most.

The things I'm most impressed with in the Openwrt firmware are:

* a real ssh that can used an ".ssh/authorized_keys" file for
industrial strength break-in resistance.

* an line editing-enabled /bin/sh look-alike

* a writable flash file system that looks just like a unix fs to the user.

* file-based and command-line based configuration so one can scp a
copy of all the router's settings to a main machine for safe backup.

* an automated in-router way to download additional software.

* IPV6 - it also works just fine for both ssh and ntp.

Anyone that has one of the affected Dlink products might want to look
into replacing the firmware with the more featureful free/open version
from http://www.openwrt.org/ .

-wolfgang
--
Wolfgang S. Rupprecht http://www.wsrcc.com/wolfgang/
Direct SIP URL Dialing: http://www.wsrcc.com/wolfgang/phonedirectory.html
Carl Byington
2006-04-13 14:40:40 UTC
Permalink
Post by Simon Lyall
http://people.freebsd.org/~phk/dlink/
I notice that most of the servers that are hardcoded in are from the
public list but many of the have access limits.
If DLink were just a little bit smarter, they would have used the
stratum-2 list rather than the stratum-1 list, and in that case would have
ended up hammering on my server. I called their Irvine offices, and
eventually spoke to their corporate counsel who seems to be in "deny
everything" mode. They have no intention of doing any sort of recall of
those boxes.

DLink uses 192.152.81.0/24 at their Irvine offices, and

ntpq -n -c peers 192.152.81.100
remote refid st t when poll reach delay offset jitter
==============================================================================
+64.7.210.145 216.218.254.202 2 u 129 256 377 7.710 5.768 4.910
*132.239.1.6 .GPS. 1 u 19 256 377 18.980 -0.428 0.870


DLink also uses 64.7.210.128/27, and

ntpq -n -c peers 64.7.210.145
remote refid st t when poll reach delay offset jitter
==============================================================================
+216.218.192.202 .GPS. 1 u 889 1024 377 19.214 -1.641 0.192
*216.218.254.202 .CDMA. 1 u 8 1024 377 16.256 -1.116 0.699
+207.200.81.113 .ACTS. 1 u 754 1024 377 10.533 0.369 3.415
-69.25.96.13 .ACTS. 1 u 464 1024 377 16.109 -7.599 0.084
66.150.161.133 .INIT. 16 u - 1024 0 0.000 0.000 4000.00
66.150.161.141 .INIT. 16 u - 1024 0 0.000 0.000 4000.00
66.150.161.133 .INIT. 16 u - 1024 0 0.000 0.000 4000.00
-128.9.176.30 .GPS. 1 u 69 1024 333 41.681 14.988 3.867

It is unclear if either of those DLink machines are obeying the access
restrictions of the servers that they are using.
Thomas Tornblom
2006-04-13 20:39:51 UTC
Permalink
Having read Poul-Hennings open letter, and finding that I had one of
the affected routers, I quickly reconfigured it to use the swedish ntp
pool instead, only to find out that this crap product can't handle
that without crashing :-(

It can also not use an ntp server on the LAN side, apparently, as all
my attempts to use one of my internal NTP-servers failed miserably.

I have now had D-link routers for almost three years, and I am ready
to declare them to be utter crap, or rather the programmers writing
code for them.

My first router was a D-link 804H, which regularly mixed up sessions,
if I was running multiple sessions of the same type (uucp over
tcp). After much struggle I got a firmware version that worked.

When the 804H broke down last summer, I quickly needed a replacement
while I got the broken one fixed/replaced, and I was handed a D-link
624, with 108 Mbps wlan.

The firmware in that router is the worst piece of crap I have ever
seen. There is almost nothing you can change in the config on that
router without the router having to reboot. And if you change almost
anything from the default, you better watch out so that it won't do
cyclic restarts.

After installation it was running fairly well, until I by accident
noticed some frequent unknown multicast traffic on my lan. I found out
that this was UPNP, Universal Plug and Play, and that it was the
router sending out the crap. I found a radio button in the web gui
that would disable this, so I disabled it. Little did I know then that
this was the start of multiple daily reboots of the router.

As I had changed a lot of other things as well, I did not immediately
connect UPNP and the reboots. I logged a service call with the Swedish
support, and they gave me several different firmware versions to try,
including some betas, all to no avail. They even replaced the router,
and this did nothing to improve things.

As the crap router can not reliably save and restore the config
between firmware versions, and the backup is in unreadable binary
format, you better do all configuration manually after each firmware
upgrade, and after a while I got bored fixing everything, so I started
doing the absolute minimum, and noticed that the router would then
stop restarting. It was then just a matter of changing one thing at a
time until it started acting up again, which happened to be when I
disabled UPNP.

After reporting this, I finally got a firmware where I could reliably
disable UPNP, and I have been running this firmware up until tonight,
when I noticed that router has now restarted everyday since I manually
changed the ntp server. That version could at least get the time from
the pool servers when it booted, but would crash each time it would do
its regular syncs.

I found that new firmware was available, and it specifically mentions
some ntp fixes, which I assume is to remove gps.dix.dk as the ntp
server to use. So I downloaded that, and (manually) configured the
router again, and selected se.pool.ntp.org as the ntp server to
use. Apparently the router can not handle this as it will not get the
time at all from that address, with the latest firmware. It will still
not be able to get the time from my internal server.

The support line is closed for easter, so I will have to call them
next week.

Another, incredibly stupid problem, with this routers firmware is that
the virtual server settings will not allow you to redirect different
ports on the wan side to different systems, using the same port, on
the lan side.

I found that when I tried to set up two virtual services for ssh,
where port 22 on the wan side would go to port 22 on system A on the
lan side, and port 10022 on the wan side would go to port 22 on system
B on the lan side. That was not allowed, and the support said that
this was by design! :-( OTOH it would probably have taken at least 10
firmware respins to get that working.

The conclusion is that I will never buy a D-link product again. My
time is worth more to me than having to play with this, which is a
pity as they are pretty simple to set up.

Thomas
Richard B. Gilbert
2006-04-13 21:33:22 UTC
Permalink
Post by Thomas Tornblom
Having read Poul-Hennings open letter, and finding that I had one of
the affected routers, I quickly reconfigured it to use the swedish ntp
pool instead, only to find out that this crap product can't handle
that without crashing :-(
It can also not use an ntp server on the LAN side, apparently, as all
my attempts to use one of my internal NTP-servers failed miserably.
I have now had D-link routers for almost three years, and I am ready
to declare them to be utter crap, or rather the programmers writing
code for them.
My first router was a D-link 804H, which regularly mixed up sessions,
if I was running multiple sessions of the same type (uucp over
tcp). After much struggle I got a firmware version that worked.
When the 804H broke down last summer, I quickly needed a replacement
while I got the broken one fixed/replaced, and I was handed a D-link
624, with 108 Mbps wlan.
The firmware in that router is the worst piece of crap I have ever
seen. There is almost nothing you can change in the config on that
router without the router having to reboot. And if you change almost
anything from the default, you better watch out so that it won't do
cyclic restarts.
After installation it was running fairly well, until I by accident
noticed some frequent unknown multicast traffic on my lan. I found out
that this was UPNP, Universal Plug and Play, and that it was the
router sending out the crap. I found a radio button in the web gui
that would disable this, so I disabled it. Little did I know then that
this was the start of multiple daily reboots of the router.
As I had changed a lot of other things as well, I did not immediately
connect UPNP and the reboots. I logged a service call with the Swedish
support, and they gave me several different firmware versions to try,
including some betas, all to no avail. They even replaced the router,
and this did nothing to improve things.
As the crap router can not reliably save and restore the config
between firmware versions, and the backup is in unreadable binary
format, you better do all configuration manually after each firmware
upgrade, and after a while I got bored fixing everything, so I started
doing the absolute minimum, and noticed that the router would then
stop restarting. It was then just a matter of changing one thing at a
time until it started acting up again, which happened to be when I
disabled UPNP.
After reporting this, I finally got a firmware where I could reliably
disable UPNP, and I have been running this firmware up until tonight,
when I noticed that router has now restarted everyday since I manually
changed the ntp server. That version could at least get the time from
the pool servers when it booted, but would crash each time it would do
its regular syncs.
I found that new firmware was available, and it specifically mentions
some ntp fixes, which I assume is to remove gps.dix.dk as the ntp
server to use. So I downloaded that, and (manually) configured the
router again, and selected se.pool.ntp.org as the ntp server to
use. Apparently the router can not handle this as it will not get the
time at all from that address, with the latest firmware. It will still
not be able to get the time from my internal server.
The support line is closed for easter, so I will have to call them
next week.
Another, incredibly stupid problem, with this routers firmware is that
the virtual server settings will not allow you to redirect different
ports on the wan side to different systems, using the same port, on
the lan side.
I found that when I tried to set up two virtual services for ssh,
where port 22 on the wan side would go to port 22 on system A on the
lan side, and port 10022 on the wan side would go to port 22 on system
B on the lan side. That was not allowed, and the support said that
this was by design! :-( OTOH it would probably have taken at least 10
firmware respins to get that working.
The conclusion is that I will never buy a D-link product again. My
time is worth more to me than having to play with this, which is a
pity as they are pretty simple to set up.
Thomas
You get what you pay for. DLink and Linksys routers are cheap and it
shows. The Linksys BEFR81 routers claim DHCP client/server support but
do not fully implement the protocol as described in RFC 2131.

I'm thinking of getting a Cisco SOHO router in the hope that it will be
better; it certainly costs enough more that the customer should be
entitled to expect more. Does anyone have experience with the Cisco
model 91 or 731?
Dave (from the UK)
2006-04-17 18:07:05 UTC
Permalink
Post by Richard B. Gilbert
You get what you pay for. DLink and Linksys routers are cheap and it
shows. The Linksys BEFR81 routers claim DHCP client/server support but
do not fully implement the protocol as described in RFC 2131.
You might consider looking at Intertex

http://www.intertex.se/products/default.asp?iMenuID=110&iItemID=54

which IMHO is pretty good. The support is excellent too via their forum

http://ix66.techarena.org/forum/

the product manager often answers questions

They are designed for SOHO use so the price is not bad, although it is
higher than US Robotics, Linksys and D-link. But it is a lot cheaper
than Cisco.

When I had a problem with my Intertex IX66 ADSL modem/router/firewall
(which was actually a telephone line problem, not the Intertex product),
they agreed to send me an advance replacement, which then sent by a
next-day couier from Sweden to England.

Of course it did not cure the problem, since it was a telephone line
issue, but I thought it was pretty good of them for a SOHO priced product.
--
Dave K MCSE.

MCSE = Minefield Consultant and Solitaire Expert.

Please note my email address changes periodically to avoid spam.
It is always of the form: month-year at domain. Hitting reply will work
for a couple of months only. Later set it manually.
Harlan Stenn
2006-04-14 04:37:23 UTC
Permalink
http://www.openwrt.org may or may not be a good/bad idea...

H
Thomas Tornblom
2006-04-18 12:39:03 UTC
Permalink
I have just realized that it may not be the D-link router that is at
fault this time, but problems with a few of the servers on
se.pool.ntp.org. The servers on the 192.36.143.x network, which are
part of se.pool.ntp.org, are not accessible from the largest ISP in
sweden, Telia, due to a long (~20 years) personal problem between
Telia and the owner of these servers.

I have now switched to use europe.pool.ntp.org instead, and it appears
to work fine.

Personally I believe the 192.36.143.x servers should be removed from
se.pool.ntp.org as long as they filter traffic from Telia.

The router can also now take time from an ntp server on the LAN. I had
problems with this previously, but that might have been a transient
problem with with my ntp server, or older firmware.

Loading...