[193097] in North American Network Operators' Group
Re: Recent NTP pool traffic increase
daemon@ATHENA.MIT.EDU (Justin Paine via NANOG)
Mon Dec 19 18:47:56 2016
X-Original-To: nanog@nanog.org
In-Reply-To: <dfdfe975-f17c-2ccf-76e5-1e27e2871167@shaw.ca>
Date: Mon, 19 Dec 2016 13:19:40 -0800
To: David <opendak@shaw.ca>
From: Justin Paine via NANOG <nanog@nanog.org>
Reply-To: Justin Paine <justin@cloudflare.com>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
the new Mario app perhaps? :)
____________
Justin Paine
Head of Trust & Safety
Cloudflare Inc.
PGP: BBAA 6BCE 3305 7FD6 6452 7115 57B6 0114 DE0B 314D
On Mon, Dec 19, 2016 at 1:12 PM, David <opendak@shaw.ca> wrote:
> On 2016-12-19 1:55 PM, Jan Tore Morken wrote:
>>
>> On Mon, Dec 19, 2016 at 01:32:50PM -0700, David wrote:
>>>
>>> I found devices doing lookups for all of these at the same time
>>>
>>> {0,0.uk,0.us,asia,europe,north-america,south-america,oceania,africa,europe}.pool.ntp.org
>>> and then it proceeds to use everything returned, which explains why
>>> everyone is seeing an increase.
>>
>>
>> Thanks, David. That perfectly matches the list of servers used by
>> older versions of the ios-ntp library[1][2], which would point toward
>> some iPhone app being the source of the traffic.
>>
>> [1]
>> https://github.com/jbenet/ios-ntp/blob/d5eade6a99041094f12f0c976dd4aaeed37e0564/ios-ntp-rez/ntp.hosts
>> [2]
>> https://github.com/jbenet/ios-ntp/blob/5cc3b6e437a6422dcee9dec9da5183e283eff9f2/ios-ntp-lib/NetworkClock.m#L122
>>
>
> That would make sense - I see a lot of iCloud related lookups from these
> hosts as well.
>
> Also, app.snapchat.com generally seems to follow just after the NTP pool DNS
> lookups. I don't have an iPhone to test that though.
>
> Thanks,
>
