Curious change in traffic - NTP

This is a discussion on Curious change in traffic - NTP ; Over the last couple of weeks I have seen a slightly strange effect over the last few weeks. Here are some NTP stats from a former NTP server of ours, plotting the iostats shown by ntpdc: http://www.maths.tcd.ie/local/admin/...almon-pps.html This machine is ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: Curious change in traffic

  1. Curious change in traffic

    Over the last couple of weeks I have seen a slightly strange effect
    over the last few weeks. Here are some NTP stats from a former NTP
    server of ours, plotting the iostats shown by ntpdc:

    http://www.maths.tcd.ie/local/admin/...almon-pps.html

    This machine is still used by a lot of "legacy" clients. For the
    last few yeas, its stats show that it usually sends and receives
    the same number of NTP packets. Since sometime about late Feb/start
    of March, it has been sending more than it receives, which is a
    little strange.

    I've no real ideas what might be causing this, other than maybe
    some software upgrade that's been performed as a consequence of the
    recent TZ change. I'm curious if anyone has any other ideas as to
    a possible cause?

    David.

  2. Re: Curious change in traffic

    David Malone wrote:
    > Over the last couple of weeks I have seen a slightly strange effect
    > over the last few weeks. Here are some NTP stats from a former NTP
    > server of ours, plotting the iostats shown by ntpdc:
    >
    > http://www.maths.tcd.ie/local/admin/...almon-pps.html
    >
    > This machine is still used by a lot of "legacy" clients. For the
    > last few yeas, its stats show that it usually sends and receives
    > the same number of NTP packets. Since sometime about late Feb/start
    > of March, it has been sending more than it receives, which is a
    > little strange.
    >
    > I've no real ideas what might be causing this, other than maybe
    > some software upgrade that's been performed as a consequence of the
    > recent TZ change. I'm curious if anyone has any other ideas as to
    > a possible cause?
    >
    > David.


    Well apart from the fact that only the US changed time zone this week,
    the only way you get amplification like this is by using queries (ntpdc
    and ntpq). If you restrict queries to only your own internal network
    does it subside? Also what does ntpdc -c monlist tell you about the
    machines contacting it?

    Danny

    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


  3. Re: Curious change in traffic

    mayer@ntp.isc.org (Danny Mayer) writes:

    >Well apart from the fact that only the US changed time zone this week,
    >the only way you get amplification like this is by using queries (ntpdc
    >and ntpq). If you restrict queries to only your own internal network
    >does it subside? Also what does ntpdc -c monlist tell you about the
    >machines contacting it?


    The client population on this machine is usually significantly
    bigger than monlist can handle, but I'll have a look through it.
    Control queries are a good call - I'll check and see if anything
    unusual is going on there. I did send a copy of our monitoring
    scripts to someone recently - I wonder if they forgot to change a
    hostname and are running them every few seconds!

    David.

  4. Re: Curious change in traffic

    David Malone wrote:
    > mayer@ntp.isc.org (Danny Mayer) writes:
    >
    >> Well apart from the fact that only the US changed time zone this week,
    >> the only way you get amplification like this is by using queries (ntpdc
    >> and ntpq). If you restrict queries to only your own internal network
    >> does it subside? Also what does ntpdc -c monlist tell you about the
    >> machines contacting it?

    >
    > The client population on this machine is usually significantly
    > bigger than monlist can handle, but I'll have a look through it.
    > Control queries are a good call - I'll check and see if anything
    > unusual is going on there. I did send a copy of our monitoring
    > scripts to someone recently - I wonder if they forgot to change a
    > hostname and are running them every few seconds!
    >
    > David.


    You should also consider upgrading it. It's running 4.1.0 which is
    pretty old. I also couldn't get a monlist out of it. I was getting bad
    responses from it with ntpdc.

    Danny
    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


+ Reply to Thread