[ntp:hackers] A stop-gap authenticated time service

Charles Elliott elliott.ch at comcast.net
Fri Nov 13 03:33:06 UTC 2015

FWIIW, my data based on many observations of ONE server (clock.nyc.he.net),
whose delay is only about 12.5+ ms from my client, between 30-50
observations up to about 300, the values I call S1, S2, and S3, are
distributed normally according to the K-S test, where S1 = T2-T1, S2 =
T3-T2, and S3 = t4-T3. Above about 300 observations the distribution is
uniform, whether due to a shift in the mean and/or standard deviation or the
presence of noise.  I prefer to think in terms of S1, S2, and S3 instead of
delay and offset because, although S2 is correlated with both S1 and S3, it
clearly must have an independent effect caused by possible other loads on
the server (say, it is also a mail server) and by the buffering of input and
output packets. I have been totally unable to convince anyone around me of
the importance of S2 though, perhaps because the values are so tiny,
O(10^-6).  In any case, you might be safe using the Normal distribution if
you used a circular data buffer of max size of, say, 300, and then ran the
K-S (or similar, more modern tests), every so often, casting out older
values if the test began to indicate non-normality.  Naturally, you would
have to refuse to issue any result if casting out older observations
decreased the buffer size below a minimum, say, 30 obs for the Normal, but
then of course, you could consider Student's T.

Charles Elliott

-----Original Message-----
From: hackers [mailto:hackers-bounces+elliott.ch=comcast.net at lists.ntp.org]
On Behalf Of Magnus Danielson
Sent: Thursday, November 12, 2015 7:16 PM
To: Poul-Henning Kamp
Cc: hackers at lists.ntp.org; magnus at rubidium.se
Subject: Re: [ntp:hackers] A stop-gap authenticated time service


On 11/12/2015 08:46 AM, Poul-Henning Kamp wrote:
> --------
> In message <56439B35.3000103 at rubidium.dyndns.org>, Magnus Danielson
>> Network "noise" breaks a bunch of assumptions, such as being stable.
> ...or even being "noise" rather than a signal.


Simple classical statistical values such as the mean and standard deviation
can vary a lot over time. There is indeed some strong systematic components
in these values at times, but completely independent strong shifts can occur
whenever. Even the shape of the distribution shifts around.

It is even common to see people mistake the properties know from "a network"
with that being the properties of any network. Similar to the non-converging
noise-forms, it requires you to think again and put the classic statistics
to the side for a moment. Saying that, using ADEV or TDEV on network noise
is also not helpful, it's another mistake right there. That's where I think
the Allan intercept method might not be completely useful in this case.

hackers mailing list
hackers at lists.ntp.org

More information about the hackers mailing list