[158063] in North American Network Operators' Group
Re: NTP Issues Today
daemon@ATHENA.MIT.EDU (Leo Bicknell)
Tue Nov 20 11:38:59 2012
Date: Tue, 20 Nov 2012 08:38:26 -0800
From: Leo Bicknell <bicknell@ufp.org>
To: nanog@nanog.org
Mail-Followup-To: nanog@nanog.org
In-Reply-To: <CAMeggd4cDQwhxQE_JbvpNR-PKKe9LXqA+KzJ97anHFonjwZhdQ@mail.gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--ew6BAiZeqk4r7MaW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
In a message written on Mon, Nov 19, 2012 at 04:21:55PM -0700, Van Wolfe wr=
ote:
> Did anyone else experience issues with NTP today? We had our server
> times update to the year 2000 at around 3:30 MT, then revert back to 2012.
I'm surprised the various time geeks aren't all posting their logs, so
I'll kick off:
/tmp/parse-peerstats.pl peerstats.20121119
56250 76367.354 192.5.41.41 91b4 -378691200.312258363 0.088274002 0.0148354=
25 0.263515353
56250 77391.354 192.5.41.41 91b4 -378691200.312258363 0.088274002 0.0186687=
90 0.263749719
56250 78204.354 192.5.41.40 90b4 -378691200.785377324 0.088179350 0.0148125=
85 0.263668835
56250 78416.355 192.5.41.41 91b4 -378691200.785974681 0.088312507 0.0148329=
43 0.209966600
56250 79229.355 192.5.41.40 90b4 -378691200.785377324 0.088179350 0.0186687=
23 378691200.785523713
56250 79442.355 192.5.41.41 91b4 -378691200.785974681 0.088312507 0.0186899=
18 378691200.786114931
Or in more human readable form:
/tmp/parse-peerstats.pl peerstats.20121119
192.5.41.41 off by -378691200.312258363
192.5.41.41 off by -378691200.312258363
192.5.41.40 off by -378691200.785377324
192.5.41.41 off by -378691200.785974681
192.5.41.40 off by -378691200.785377324
192.5.41.41 off by -378691200.785974681
The script, if you want to run against your own stats:
#!/usr/bin/perl
while (<>) {
chomp;
($day, $second, $addr, $status, $offset, $delay, $disp, $skew) =3D split;
if (($offset > 10) || ($offset < -10)) {
# print "$addr off by $offset\n"; # More human friendly
print "$_\n"; # Full details
}
}
It just looks for servers off by more than 10 econds and then prints
the line. 378691200 seconds is ~12 years, which lines up with the
year 2000 dates some are reporting.
The IP's are tick.usno.navy.mil and tock.usno.navy.mil.
I can confirm from my vantage point that tick and tock both went about
12 years wrong on Nov 19th for a bit, I can also report that my NTP
server with sufficient sources correctly determined they were haywire
and ignored them.
If your machines switched dates yesterday it probably means you're
NTP infrastructure is insufficiently peered and diversified.
--=20
Leo Bicknell - bicknell@ufp.org - CCIE 3440
PGP keys at http://www.ufp.org/~bicknell/
--ew6BAiZeqk4r7MaW
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)
iQIVAwUBUKuyAbN3O8aJIdTMAQKBUw//cMwjwziFGwyk5Tw+h206A4PIRD4WGsdQ
E3C2zf/JiW5EReiY4HAKYVeXRy9Wr3749HVLLrHdtc66YOZhf63Tl3uxZa/sYmKb
8amsJSQfaHt3qzAm2vKxKx69QY6JwEPfh7G/yKhF/oyQ7+dIXf1OfHj2+DSSDuC+
+y18lP4YfC2XNtch8MYflgzMHdN+Jqo5y/XZ8uPnazni46hfkaorZpXwbyStQ1nT
mYDUrPP3gAgAIwlMZC00jpGTxMIeLBHIUj62ik/pL4AcUOoPCGSgdReyra1n8Ew3
Yr2QS6cpuJm7r1jD8s4UB3YNr1eqZHXAhOZOCw4T+b424d9mIrDj1TNHwdkxQrsY
oTmKOUuZtT4PaC8arP1NFmJc8TEFx2O7/WeKaOXkkvtD6baq5AmxJU5Absd/amED
61tKhSx+fw7fvLX1iBd4+TvqY2VRxH6k0aaJBaNG33e7kC1SmNijbLljeVJ69nxV
D6s1ty/7zUGupVs5skwB5tZaRl437MjY3Pxn3DgLmUXAqVa9/bJkmJJklTQpK1Gt
rOmNyLXeFq4tcXQnxnj4EdJMp96LtvGRu1CjXyKM/L5q22GfvBplgM4TDeNOL+/C
aEXBrQN2I+eV9VPJ4MDGNQtlfuOsveSftGCEKLcDARO1XZdu3A9z9UKvI/ku3CDX
8mOc459Rgn8=
=er9e
-----END PGP SIGNATURE-----
--ew6BAiZeqk4r7MaW--
