[ntp:questions] Question on abusive clients.

Karel Sandler sandler at ujf.cas.cz
Wed Dec 21 23:16:12 UTC 2005


My question is, if there is a possibility how to distinguish between a 
misconfigured client or a grup of more or less standard clients behind a 
NAT. Originally, I thought, it would be easy. Ideally, the timestamps of a 
single client requests create an equidistant ladder with steps equal to some 
integer (maybe with some slide besides of time delay disorder). But a look 
on the two following graphs does not allow me to make any clear conclusion.
http://lx.ujf.cas.cz/~sandler/ntp/1_1.png
Are those requests from a single client? Generally, I expected other slides 
for distinct clients.
http://lx.ujf.cas.cz/~sandler/ntp/2_1.png
Like a single client and then a sudden link improvement?
There are also 1_2.png, ... and so on, with higher resolution.

Karel Sandler 





More information about the questions mailing list