[time] good news and bad news

Nicholas Suan nsuan
Wed Nov 5 22:03:52 UTC 2003


wayne wrote:
> 
> Well, I have some good news and some bad news.
> 
> 
> The good news is that there appears to be a stead increase in the
> number of people using pool.ntp.org.  (I currently have around 65
> connections that have polled within the last 1024 seconds.)
> 
> 
> The bad news is that there appears to be quite few sysadmins that are
> using pool.ntp.org instead of properly configuring a local ntp server
> and the pool is experiencing the same kind of "abuse" that all public
> ntp servers experience.  Yes, I know, this is very shocking news that
> none of us expected. </sarcasm>
> 
> 
> The following command gives a quick check of the class C subnets that
> have made many connections to my ntp server:
> 
> $ ntpdc -nc monlist | tail +3 | while read ip junk; do echo $ip | sed "s/.[0-9][0-9]*$//"; done | sort | uniq -c | sort -nr | head
>      11 63.211.151
>      11 194.93.174
>       7 206.222.212
>       6 212.67.172
>       4 194.93.175
>       4 148.71.242
>       3 217.80.176
>       3 203.130.2
>       3 200.41.33
>       3 148.71.243
> 
> The 206.222.212.xxx subnet is my subnet, so that's ok.  The
> 63.211.151.xxx and 194.93.174.xxx subnets, on the other hand, could
> really use a local ntp server.  They would get better performance,
> cause less network traffic and less load on the pool ntp servers if
> they did.
> 
Doing a little poking around with tcpdump leads me to believe that the 
hosts in the 63.211.151/24 segment do have a central ntp server, 5/7ths 
of the clients had the same refid. (The other two were also synced to 
the same soruce)


More information about the pool mailing list