[ntp:questions] OS users (was: Re: What level of timesynch error is typical onWinXP?)

Chuck Swiger cswiger at mac.com
Thu Nov 4 19:19:56 UTC 2010


On Nov 4, 2010, at 10:45 AM, Ryan Malayter wrote:
> On Thu, Nov 4, 2010 at 2:34 AM, David J Taylor
> <david-taylor at blueyonder.co.uk.invalid> wrote:
>>> As to Linux, I would guess most users of ntpd are using Linux.
>>
>> Any figures to back that up?  Within my community of several  
>> hundred users,
>> almost all are Windows, but behind firewalls and not visible to  
>> outside
>> surveys.  You may be underestimating the appreciation the Windows  
>> community
>> has for NTP.  A pity in a way that there nothing like the User- 
>> Agent field
>> in the NTP packet to that servers knew what OS the client was using  
>> (or is
>> there?).

"ntpq -c rv", if permitted, will display the OS:

% ntpq -c rv pi.codefab.com
assID=0 status=0664 leap_none, sync_ntp, 6 events, event_peer/strat_chg,
version="ntpd 4.2.4p5-a Mon Sep 20 14:30:32 EDT 2010 (1)",
processor="i386", system="FreeBSD/6.4-STABLE", leap=00, stratum=2,
[ ... ]

> IP fingerprinting could be a solution to this, but it seems that most
> tools rely on active probing (such as the popular nmap). Passive
> fingerprinting scanners such as p0f seem to only work on TCP traffic,
> not UDP. Perhaps there just isn't enough information in a UDP packet -
> or series of UDP packets - for reliable fingerprinting.

nmap uses active fingerprinting, by sending a sequence of specially  
crafted packets to probe the stack behavior.  Passive fingerprinting  
is also possible, but as you say, UDP doesn't provide nearly as much  
info as TCP does to help narrow down possible choices.  Just the  
default TCP options will generally identify the OS....

Anyway, from http://en.wikipedia.org/wiki/Usage_share_of_operating_systems

"Web client stats suggest that Microsoft Windows has about an 88%  
share, Apple Mac OS 7% and Linux 1%. The correlation between desktop  
share and web client share is being increasingly challenged by the  
rise of mobile web access, which rose through 1% in 2009 and 4% in  
2010."

I don't think anyone would debate that Windows boxes are the largest  
users of NTP as clients, but I daresay that the breakdown of NTP  
_servers_ by platform would show a lot more FreeBSD (+ NetBSD/OpenBSD/ 
etc) and Solaris boxes then what desktop client browsing stats might  
indicate, likely followed by MacOS X and Linux....

Regards,
-- 
-Chuck




More information about the questions mailing list