Welcome! Log In Create A New Profile

Advanced

National Institute of Standards and Technology

Posted by Anonymous User 
Anonymous User
National Institute of Standards and Technology
May 20, 2011 01:42AM
I recently visited the NIST website, turned on peer blocker, and now all of a sudden their IP is pinging me every 2 minutes on the dot.

Why are they pinging me?
Anonymous User
Re: National Institute of Standards and Technology
May 26, 2011 04:41PM
I have the EXACT same issue, this is quite weird, I cannot see a reason for them to be doing this, I'm going to run a clean of my PC and all cookies and off line data ... I didn't not install ANYTHING other than read a PDF they've published.

Let me know if you have any luck as I will too!
Anonymous User
Re: National Institute of Standards and Technology
May 27, 2011 05:18AM
NO LUCK! I can't get them to stop, hmmmmmm!
Anonymous User
 
May 27, 2011 08:05PM
More details, please.

Which URLs did you use on their two sites?

What IP addresses are pinging you and on which ports/protocols?

Show some logs so I can find how to get them to ping me and analyze the packets.
Anonymous User
Re: National Institute of Standards and Technology
June 01, 2011 03:39PM
I've recently noticed this happening on my PC as well.
To my knowledge I've never visited a NIST website before, and actually I've never heard of them before they started pinging me every 2 minutes.
I e-mailed their IT dept. to see if they can shed any light on the situation and will post any response here.
and attached is the log file I saved this morning.

Thx for the awsome program Peerblock!
Attachments:
open | download - blocked.txt (110.4 KB)
Anonymous User
Re: National Institute of Standards and Technology
June 01, 2011 06:11PM
The following is the responce I recieved from the NIST. Will be checking through my system to find the culprit and shut it down.

Hello,
The messages in your log file are coming from the daytime time service on our servers. It looks like you have a process that is sending queries to several of our time servers almost exactly 2 minutes apart. These systems do not send unsolicited messages -- they only respond to queries.

The activity is suspicious because the process is sending queries to several different time servers located in Boulder, Colorado and Gaithersburg, Maryland.

The first thing to look for is to see if you have a program that you installed to adjust the clock on your system using queries to our time servers. There are many different third-party programs that do this. If you have such a program then either you should allow the messages that it generates to reach our servers and for the replies to pass back to your system or you should disable the program if you don't want to generate these queries and allow them to pass through your firewall system.

If you did not install such a program then it is possible that your system has been compromised and the program was installed without your knowledge. This is possible, but I think it is less likely because the query interval is not fast enough to be considered a problem by the time service monitors; most of the problem programs send queries much more rapidly than every 2 minutes.

Judah Levine
Time and Frequency Division
NIST Boulder
Anonymous User
 
June 03, 2011 09:52AM
That is probably your operating system trying to set the clock.

time-a.nist.gov, time-b.nist.gov:129.6.15.28-129.6.15.29
time-a-c.timefreq.bldrdoc.gov:132.163.4.101-132.163.4.103

They are just time servers Windows uses by default. I see no reason to block these so I'll open them up.

In the meantime you can pick another server which is much closer and set Windows to use that one.
That will be more accurate than the defaults because fewer people use them and they are closer.
Here is the official list of Stratum Two Time Servers that control most of the rest in the world.
You can see their locations when you click on the server names. Use the "OpenAccess" servers only.
Check the servers in states next to yours and pick the closest one. To set your PC's clock, double-click
the time in the right end of the desktop taskbar and put the server in the name box of the Internet Time tab.
Test it with the Update Now button to make sure it works. If not, post the server's name and I'll unblock it.

As a backup, add these United States NTP Pool Zone names to your list:

0.us.pool.ntp.org
1.us.pool.ntp.org
2.us.pool.ntp.org
3.us.pool.ntp.org

They link automatically to a nearby server but you can't predict which until you try them.

If any more time servers turn out to be blocked I'll unblock them right away.



Edited 2 time(s). Last edit at 11/14/2011 06:47AM by Aaron.Walkhouse.
Re: National Institute of Standards and Technology
June 03, 2011 03:06PM
192.43.244.18 National Center for Atmospheric Research
129.6.15.29 (National Inst)
131.107.13.100 (Microsoft)

Atomtime Pro uses those IPs to synchronize the time, I'd appreciate at least the top two taken out since they seem harmless.
Anonymous User
 
June 15, 2011 04:17PM
Got'em. ;]
Sorry, only registered users may post in this forum.

Click here to login