[158058] in North American Network Operators' Group
Re: NTP Issues Today
daemon@ATHENA.MIT.EDU (Sid Rao)
Tue Nov 20 10:56:50 2012
From: Sid Rao <srao@ctigroup.com>
To: George Herbert <george.herbert@gmail.com>
Date: Tue, 20 Nov 2012 03:58:15 +0000
In-Reply-To: <CAK__Kzt8T0QV9tLddbDFr83advy7=xo38ZaJzv_DdrqR1V4VFw@mail.gmail.com>
Cc: outages <outages@outages.org>, "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
We had multiple servers synchronized with Windows/MS time change their cloc=
k to the year 2000 today. It broke many things, including AD authenticatio=
n.=20
These servers had been properly synchronized for years.=20
They were synchronized with Microsoft and NIST NTP servers.=20
This may not be isolated.=20
Sid Rao | CTI Group | +1 (317) 262-4677
On Nov 19, 2012, at 10:29 PM, "George Herbert" <george.herbert@gmail.com> w=
rote:
> crossreplying to outages list.
>=20
> Is anyone ELSE seeing GPS issues? This could well have been an
> unrelated issue on that particular PBX.
>=20
> If this was real, then the mother of all infrastructure attacks might
> be underway...
>=20
> One glitch on tick and tock and one malfunctioning PBX is not
> sufficient evidence of pattern - much less hostile activity - to
> induce panic, but it would perhaps be a wise time to check
> time-related logs?
>=20
>=20
> -george
>=20
> On Mon, Nov 19, 2012 at 6:08 PM, Wallace Keith
> <kwallace@pcconnection.com> wrote:
>> Just got paged with a pbx alarm that had 1970 as the year. By the time I=
logged in , it was showing 2012. Using GPS for time and date.
>>=20
>> -----Original Message-----
>> From: Mark Andrews [mailto:marka@isc.org]
>> Sent: Monday, November 19, 2012 8:42 PM
>> To: Van Wolfe
>> Cc: nanog@nanog.org
>> Subject: Re: NTP Issues Today
>>=20
>>=20
>> In message <CAMeggd4cDQwhxQE_JbvpNR-PKKe9LXqA+KzJ97anHFonjwZhdQ@mail.gma=
il.com>
>> , Van Wolfe writes:
>>> Hello,
>>>=20
>>> Did anyone else experience issues with NTP today? We had our server
>>> times update to the year 2000 at around 3:30 MT, then revert back to 20=
12.
>>>=20
>>> Thanks,
>>> Van
>>=20
>> NTP should be immune from this sort of behaviour unless you did a ntpdat=
e at the wrong moment. The clocks should have been marked as insane.
>>=20
>> Mark
>> --
>> Mark Andrews, ISC
>> 1 Seymour St., Dundas Valley, NSW 2117, Australia
>> PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
>>=20
>>=20
>=20
>=20
>=20
> --=20
> -george william herbert
> george.herbert@gmail.com
>=20
>=20
