Feeds

D-Link accused of 'killing' time servers

Time to stop freeloading

Reducing the cost and complexity of web vulnerability management

Networking manufacturer D-Link is facing an escalating row over how its kit queries internet time servers.

Critics claim the way D-link equipment polls NTP (Network Time Protocol) servers is impairing their operations, leaving operators to carry unsustainable excess bandwidth charges. NTP servers handle a variety of functions including, for example, helping to create a record of the timing of eBay bids.

The row kicked off after self-confessed "time geek" Poul-Henning Kamp wrote an open letter to D-Link prompted by his frustrations in attempting to get the firm to acknowledge that a misconfigured implementation of NTP on its kit left him staring at a bill of around $8,800 a year. D-Link products worldwide query a small NTP server located at the Danish Internet Exchange, intended to service only 2,000 or so organisations in the country. Kamp reckons that between 75 and 90 per cent of the traffic hitting his servers comes from D-Link devices. Growing costs have forced Kamp to consider abandoning his time-keeping service.

The address of Kamp's NTP server - which is run on a non-profit basis and allocated only minimal bandwidth resources - was hardwired into the firmware in various D-link products. A more flexible approach would have seen the products reconfigured remotely and redirected to a more appropriate NTP server.

Kamp asked D-Link to take steps to reduce the impact of the problem. Acknowledging that a complete fix wasn't possible (because the "bad" bahaviour of D-Link's routers, switches and wireless access point was established by default configurations), Kamp asked D-Link to cover his excess costs. Since Kamp's open letter other NTP operators have come forward with similar complaints.

D-Link is freeloading onto as 50 NTP time servers, critics claim. The BBC reports that US military Nasa and government groups worldwide are running NTP servers interrogated by D-Link kit.

Security expert Richard Clayton, from the security research lab at Cambridge University, who first tracked back the source of unwanted international traffic sent to Kamp's Danish NTP server to D-Link kit, reckons D-Link would rack up $1,000 a month in bandwidth charges if it ran those time servers itself.

D-Link, for its part, is hiding behind its lawyers. Instead of acknowledging it might have made an error, and operators say D-Link's attorneys have accused them of "extortion" or else demanded that disgruntled punters submit to Californian law.

A D-Link spokesman said the firm was aware of the issue but said it wasn't prepared to discuss complaints publicly until its "legal counsel advises on the matter". D-Link may come up with a statement after Easter, El Reg was told. ®

Choosing a cloud hosting partner with confidence

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.