Feeds

D-Link accused of 'killing' time servers

Time to stop freeloading

Internet Security Threat Report 2014

Networking manufacturer D-Link is facing an escalating row over how its kit queries internet time servers.

Critics claim the way D-link equipment polls NTP (Network Time Protocol) servers is impairing their operations, leaving operators to carry unsustainable excess bandwidth charges. NTP servers handle a variety of functions including, for example, helping to create a record of the timing of eBay bids.

The row kicked off after self-confessed "time geek" Poul-Henning Kamp wrote an open letter to D-Link prompted by his frustrations in attempting to get the firm to acknowledge that a misconfigured implementation of NTP on its kit left him staring at a bill of around $8,800 a year. D-Link products worldwide query a small NTP server located at the Danish Internet Exchange, intended to service only 2,000 or so organisations in the country. Kamp reckons that between 75 and 90 per cent of the traffic hitting his servers comes from D-Link devices. Growing costs have forced Kamp to consider abandoning his time-keeping service.

The address of Kamp's NTP server - which is run on a non-profit basis and allocated only minimal bandwidth resources - was hardwired into the firmware in various D-link products. A more flexible approach would have seen the products reconfigured remotely and redirected to a more appropriate NTP server.

Kamp asked D-Link to take steps to reduce the impact of the problem. Acknowledging that a complete fix wasn't possible (because the "bad" bahaviour of D-Link's routers, switches and wireless access point was established by default configurations), Kamp asked D-Link to cover his excess costs. Since Kamp's open letter other NTP operators have come forward with similar complaints.

D-Link is freeloading onto as 50 NTP time servers, critics claim. The BBC reports that US military Nasa and government groups worldwide are running NTP servers interrogated by D-Link kit.

Security expert Richard Clayton, from the security research lab at Cambridge University, who first tracked back the source of unwanted international traffic sent to Kamp's Danish NTP server to D-Link kit, reckons D-Link would rack up $1,000 a month in bandwidth charges if it ran those time servers itself.

D-Link, for its part, is hiding behind its lawyers. Instead of acknowledging it might have made an error, and operators say D-Link's attorneys have accused them of "extortion" or else demanded that disgruntled punters submit to Californian law.

A D-Link spokesman said the firm was aware of the issue but said it wasn't prepared to discuss complaints publicly until its "legal counsel advises on the matter". D-Link may come up with a statement after Easter, El Reg was told. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
NASA launches new climate model at SC14
75 days of supercomputing later ...
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
You think the CLOUD's insecure? It's BETTER than UK.GOV's DATA CENTRES
We don't even know where some of them ARE – Maude
DEATH by COMMENTS: WordPress XSS vuln is BIGGEST for YEARS
Trio of XSS turns attackers into admins
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
BOFH: WHERE did this 'fax-enabled' printer UPGRADE come from?
Don't worry about that cable, it's part of the config
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.