[ntp:questions] Using two NTP Server: Bad?

unruh unruh at wormhole.physics.ubc.ca
Fri Apr 22 16:05:51 UTC 2011

On 2011-04-22, Roger <invalid at invalid.invalid> wrote:
> On Fri, 22 Apr 2011 15:19:31 GMT, unruh
><unruh at wormhole.physics.ubc.ca> wrote:
>>On 2011-04-22, Roger <invalid at invalid.invalid> wrote:
>>> On Thu, 21 Apr 2011 09:32:21 -0400, "Richard B. Gilbert"
>>><rgilbert88 at comcast.net> wrote:
>>>>One server: if it fails you have nothing!
>>>>Two servers: If the two differ, which one do you believe?
>>>>Three servers: degenerates too easily to the two server case.
>>>>Four servers: Allows the failure of one server.
>>>>Five servers: Allows the failure of two.
>>>>Seven servers: Allows the failure of three.
>>> I've seen these number quoted before and I don't understand
>>> the last one. Why doesn't 6 allow for the failure of 3? Why
>>Because 3-3 is a tie and the system cannot decide which is best. Ie by
>>failure, read "bad timekeepers". If 3 fail-- ie stop responding to 
>>packets, 6 is pleanty. 4 would be enough. But if they fail by delivering
>>the wrong time, and all three deliver the same wrong time (say because
>>all three are in Chicago and all three used a cell phone system to set
>>the time and .... ) then you have a tie. 
>>It starts to get a bit absurd, I know. 
> Thank you, and David and Dave.
> I hadn't thought about a 3-3 tie. I hadn't even considered that
> that might happen. But if that is possible then so is a 2-2 tie
> with 4 servers. Ho hum, nothing is perfect in this life.

That is why 4 is considered to be able to withstand one bad clock, not 2
and 6 gives 2 bad not 3. Ie, you figure out the chances of getting x bac
tickers which all give the same bad time, and take at least 2x+1 servers
if that chance is too large for you. 

Which is why the current pool.ntp.org ntpd policy of grabbing 10 sources
suggests that they consider the chance of a pool giving a bad ticker to
be about 13% (to give only a 1% chance of getting more than 4 false

(In fact increasing the number from 9 to 10 clocks increases the chances
of getting more than 4 false tickers. The argument that you need 2x+2 is
obscure to me. )

More information about the questions mailing list