[ntp:questions] How should an NTP server fail?

David Mills mills at udel.edu
Sat Jun 5 20:11:55 UTC 2010


This issue is widely misunderstood; yours is the second such message to 
me today. So, please spread the word.

When a server loses all sources it does not necessarily become 
unsuitable for downstream clients. Ordinarily, it inherits error 
statistics from upstream servers and provides them to downstream 
clients. Servers and clients use these statistics to calculate the 
maximum error statistic which represents the maximum clock error 
relative to the primary reference clock. See the error budget called out 
in the specification. Once determined, the maximum error increases at a 
rate (15 PPM) determined as the maximum disciplined clock frequency 
error of the server clock. This increase continues indefinitely or until 
the sources are again found.

Downstream clients monitor the maximum error against the selection 
threshold, by default 1.5 s. Once exceeding the threshold, the server is 
never selected for synchronization. Note that, even at this level the 
server may still be a credible choice, as the expected clock frequency 
error of a disciplined oscillator is usually within 1-2 PPM. Meanwhile, 
if there are other sources for the downstream clients, these sources 
quickly capture the selection process and the server without sources 
becomes irrelevant.


goofyzig wrote:

>Hi there.  A quick question about what to expect when it comes to NTP
>failures.  I configured a Meinberg NTP server (software-based server),
>had it working, serving time to the back-end hosts,  Reachability at
>377 for its two NTP upstream time sources (internet NTP servers).
>Once configured, I wanted to see how the server failed.
>My expectation was that once Reachability went to zero, the server
>would stop serving time since it no longer has a source itself.  So I
>blocked port 123 UDP/TCP at the firewall, and sure enough,
>Reachability for the two upstream sources slowly wound down from 377
>to zero.  However, once Reachability got to zero, the Meinberg NTP
>server CONTINUED to serve time, and CONTINUED to say that each of the
>two upstream servers were believable, as if it was still getting time
>from them (but it was not).  I confirmed the drops at the firewall.
>The Reachability was at zero, so I know the Meinberg software was not
>getting NTP time from anywhere.  Yet, it kept serving NTP time to its
>back-end hosts, and kept saying that ach of the two upstream servers
>were good (one colored green, the other yellow, with the * and the +
>signs next to them).   After 5 hours of zero Reachability, nothing
>So my question is:  how long does it take before the Meinberg server
>declares itself in a "failed" state and stop serving NTP?  Is that how
>it's supposed to work?  I looked all over the Meinberg site and could
>not find any forum or literature regarding how the NTP server is
>expected to fail.  Maybe Im missing a setting?  Thanks for any
>help!!! :)
>questions mailing list
>questions at lists.ntp.org

More information about the questions mailing list