Effect of using "ntp allow mode control 0"?

[jonathan.e.brown]

I am attempting to mitigate the issues surrounding bug report CSCum44673.  According to the software release notes found here, I need to ensure that all of my routers are on IOS version 15.2(2) or newer.  I also believe I need to include the statement "ntp allow mode control 3" on each of them. 

So far I've verified that all of my routers are on newer software versions than that.  What I am confused about is that many of them include the statement, "ntp allow mode control 0".  I was under the impression that the only allowed values were from 3 - 15.  I was also under the impression that a value of 3 was the default value.

What is the effect of using a 0 for the value? 

Does this effectively mean that rate limiting of ntp queries is turned off and that the router is still vulnerable to the potential DoS attack described in that bug report? 

Is this command only useful if the router is setup as an ntp master ("ntp master 3" for example in the config)? 

If it is only configured to synchronize with an ntp server located elsewhere ("ntp server x.x.x.x" in the config) does this command have any use?

Thanks for any clarification.

[eperezor · Accepted solution]

It might be too late, I know, but for others to search on this:

run "ntp allow mode control 0" to disable the feature?
By using this, the device will respond to the mode 6 packets without any delays and this would help in DOS attacks

OR configure the parameter with 3 second rate control, for example, "ntp allow mode control 3"
You can use this one, and due to the rate limit added in the newer versions the device is responding but not affected the same way so it's considered non vulnerable

there is actually no default value configured to "ntp allow mode control"
You want to enable this feature you need to set the value manually

For Disabling this feature:
[ no ntp allow mode control ], and this would drop any mode 6 packets received.

[Rich R]

Thanks @eperezor - can you raise a bug to get the IOS command reference updated to reflect this information.  There's literally no documentation on "ntp allow mode control" other than brief mentions in bugs, release notes (listing the bugs) and here!

I also found Solved: ntp allow mode control - Cisco Community useful for anyone else finding this.