Cannot sync network time (NTP) on Win10 on BSNL FTTH

  • Thread starter Thread starter vishalrao
  • Start date Start date
  • Replies Replies 82
  • Views Views 14,375
I got a call from someone in the Bangalore NOC today asking me about the issue which I explained as best I could. Now waiting for a follow-up from their side for any further updates.
 
Untitled.png


I read through this thread and @vishalrao is correct. I did WireShark on UDP Port 123, first on my regular WiFi Interface on Windows 10 pressing sync button (top picture) and the source port isn't random as it should be (same as dst port). MS must have screwed up?

Bottom one is a picture of WireShark on UDP Port 123 but on WSL Interface, this time I did "ntpdate -q time.windows.com" on my Ubuntu WSL. Source Port is random on Linux.

Someone should complain to MS About this.

NTP does seem to work fine with random port on BSNL. Here is a RIPE Atlas measurement (i assume Atlas uses random source port as its running on Linux?). Atlas Console

@vishalrao If you have a fancier firewall such as Mikrotik or PFSense or Openwrt , you maybe able to rewrite the src port 123 to a random port using NAT/Firewall Rules.
 
Last edited:
Nice link... and no I don't have a fancy router software to try this.
 


I had posted the issue on Microsoft forum but no response or anything from them.
 
Could be the same problem of using source port 123

Still doesn't change that it's silly to not use random source ports.
 
Last edited:
@BraveHunt If the cams have an option to change NTP Server, what you can do is setup your own NTP Server on something like Pi as @shashankb suggested.

You can easily customize the source port that your local NTP Server uses to contact stratum servers.

Kinda similar to using DNS on another port (DoH or DoT though DNS is also encrypted in this case) if ISP hijacks destination port 53 (but in this case its source port instead).
 
Last edited:
I think they are correct. The last DDOS attack on BSNL network was a result of hijacked ONT asking for time...
So, they made a band aid solution as it is in their blood.
Instead of asking vendors to provide reguler patches to dumb ONT, they put a tape on the leaking tank...
Dont expect much more from them. I got to know recently that nobody in my exchange know about traceroutes and why they change with time and how packets travel. So, i am quite happy they did something.
 

Related maybe?

BSNL aren't the first ISP to do it though tbf

AT&T blocks outbound UDP traffic with source port 123, to mitigate common NTP reflection attacks from compromised machines on customer networks. Destination port 123 is allowed, but most NTP clients use 123 for the source port as well.
 
Last edited:
My friend had to call the Backend directly for opening multiple ports as they were working on some project . So BSNL hooked him up with a network engineer . He did not know basic Network skills , my friend had to take Anydesk remote of the BSNL side and get his work done . That guy also had no clue about Cisco CCNA

Instead BSNL providing you support ,it is the other way
 

Top