Very interesting post, I&#x27;ve suggested to Brad that he consider probes with a decreasing ttl in the packet to see if the harvesting is happening at an interstitial node or directly on the ntp server. If you had access to a compromised Juniper router it would be straight forward to add a rule to mirror packets which were headed to the NTP pool addresses.<p>Oddly after being an unwitting participant in one of the NTP amplification attacks I set up my own stratum 0 NTP server based on the beaglebone black, the adafruit GPS module, and the PPS time keeper code. So all of my machines only talk internally for time, although initial installs still use what ever the distro packed into them. I brought up Debian on a Dragonboard 410c and it sets the time via an NTP call during the initial startup process. (or fails to set the time as NTP is blocked egress&#x2F;ingress from the firewall)