If someone is detecting which IPv6 addresses are in use in your range from NTP requests, that implies they are all talking to the external NTP servers directly.
Surely if all your internal hosts are talking directly to the external NTP servers you are doing it wrong? My gateway box sets itself by pool.ntp.org and the internal ones set themselves by it. I thought that was how you should do things (even if it isn't a rule, it is only polite to try not overuse a public resource).
> These addresses are 128 bits in length
Only 64 are relevant here: once you make outgoing connections from any address a scanner knows there is at least one active host in that /64 and there may be more. Though of course a 64 bit address space is still impractical to scan.
> Surely if all your internal hosts are talking directly to the external NTP servers you are doing it wrong? My gateway box sets itself by pool.ntp.org and the internal ones set themselves by it. I thought that was how you should do things (even if it isn't a rule, it is only polite to try not overuse a public resource).
Depends on how many internal hosts you have, and ease of configuring them (there is a DHCP option for ntp server, but not everything will use it), and available hardware to setup ntp servers: ideally you would have each client syncing from three servers so the clients drop a broken server.
> ideally you would have each client syncing from three servers
For a small network (a home or small office network for instance) you likely have one incoming router anyway, so if that dies clock setting is the least of your worries until it comes back up, meaning setting the internal hosts by that one clock is as fine as anything else.
For a larger network you have redundant everything, including edge servers that can act as your multiple NTP sources for internal hosts rather than every internal host poking the public pool.
> For a small network (a home or small office network for instance) you likely have one incoming router anyway, so if that dies clock setting is the least of your worries until it comes back up, meaning setting the internal hosts by that one clock is as fine as anything else.
I'm not so much worried about the router dieing and losing sync with the outer world; but about the router's clock going wonky: I've seen computers where something got initialized wrong and they were 30 minutes slow after 10 hours (reboot helped in that case, but sometimes it's the oscillator is just too far off)
You are surely doing something wrong with ntp if you only have one time source configured. The only configuration that I can think of that would be worse is to have a setup with two time sources.
Surely if all your internal hosts are talking directly to the external NTP servers you are doing it wrong? My gateway box sets itself by pool.ntp.org and the internal ones set themselves by it. I thought that was how you should do things (even if it isn't a rule, it is only polite to try not overuse a public resource).
> These addresses are 128 bits in length
Only 64 are relevant here: once you make outgoing connections from any address a scanner knows there is at least one active host in that /64 and there may be more. Though of course a 64 bit address space is still impractical to scan.