The university's administrators noticed a dramatic increase in in-bound traffic to its time server, and eventually traced the cause to a Netgear router product. A full analysis was posted on the university's Web site.
The router was hard-coded to synchronise its clock to the university's time server, meaning that every unit sold and deployed began bombarding the machine with requests as often as once a second.
"I have counted more than 500,000 unique Netgear sources that queried our time server in one day. This measurement likely underestimates the actual count," the analysis read. "As of June 30, 2003, Netgear reported a total of 707,147 affected products manufactured."
A similar problem forced the CSIRO to take down its public time server in April this year after a US manufacturer, SMC, hard-coded its network time server into its code. The flood of requests from 85,000 of the devices proved too difficult to service.
Dave Plonka, who wrote the analysis, is planning on educating vendors on the down-side of hard-coding IP specific servers into their products.
"I am in the process of preparing an Internet Draft, currently titled 'Embedding Globally Routable Internet Addresses Considered Harmful', which denounces the practice of embedding unique, globally routable IP addresses in Internet hosts, describes some of the resulting problems, and considers selected alternatives."
In a joint statement, the university's chief information officer, Annie Stunden, said Netgear had worked closely with the university to "understand the issue and minimise any impact".
Netgear has released a firmware upgrade for the products causing the problem.
It seems to me that NetGear et. al. could put up their OWN time server, and hardcode their OWN address into their routers. Then they will be able to control the address of the hardcoded time server. Right now, all of the routers are vulnerable to the univesity changing the DNS name and IP address of their time server.
Or, simply don't hardcode any addresses and let the customer control that sort of thing. Many people would prefer pointing NTP requests at servers that THEY control.