[ntp:questions] Re: why is it so important that your serversall have the same notion of time?

Maarten Wiltink maarten at kittensandcats.net
Sun Dec 12 17:48:49 UTC 2004


"Folkert van Heusden" <folkert at vanheusden.com> wrote in message
news:mailman.69.1102871789.54146.questions at lists.ntp.isc.org...
[...]
>> There are no disadvantages to having all machines perfectly
>> synchronized, and a number of advantages.  There are times when
>> knowing the order in which things happened across systems to
>> within a fraction of a second is crucial to postmortem debugging,
>> analysis, and security auditing.
>
> Ah yes ok, but that's already the situation: all computers overthere
> are synced so they have all the same notion of time. But what would
> be the advantage of them all also having the same notion of time
> compared to the rest of the world?

Sometimes postmortem debugging, analysis, and security auditing doesn't
end at your doorstep.

I once reported a port scan to my ISP (this was before I learned about
NTP), and they asked how accurate the timestamps on my logs were. Strike
one: I didn't know at all. When the return mail came in, the machine was
within three minutes of real time, so I told them that as the next best
guess.

That narrowed it down to only three people on their side. The wonders
of dial-up. Within three minutes the IP address in my logs had belonged
to as many people.

Groetjes,
Maarten Wiltink





More information about the questions mailing list