A Survey of the NTP Network

Network Time Protocol

• Synchronize clocks across Internet
• Hosts run a long lived server keeping time
• Stratum 1 clocks have external time (GPS, WWVB, etc)
• UDP packets between peers
• Peers organized by stratum
• Semi self-organizing
• About 10 years old, NTP3 from March 1992
• Has a built in diagnostic facility

Survey Experiment

• Spider the NTP network
• Start with set of roughly 200 well known servers
• Query each one for information
  • sysinfo: clock state
  • peers: who it gets time from
  • monlist: who gets time from it
• Compare to previous experiments

Why Study NTP?

• NTP is an important facility
• Small community of knowledgable people
• Previous results offer some basis to compare
• NTP has grown quietly over time, little administration
• How well does semi self-organizing work?
• Overlay network: a net inside the Internet
• Spidering is fun!

Notes from the Survey

• Implementation must be mulithreaded (timeouts)
• Keep data on disk simple, make sure you can restart
• NTP queries are cheap, one host can do the work in 5 days
• Tripped all sorts of security alarms
• Suggestion: use DNS to inform people what you are doing
• Make this data available on the net

Results

• NTP network size
• Timing information
• Topological information
• Quality of stratum 1 clocks

NTP Network Size

• How big is this network?
• What kind of clocks are out there?
• Hard to estimate:
  • Firewalls
  • Transient clients
  • Lost query packets
  • Network is quite dynamic
  • I found 2500 peers to tick.usno.navy.mil
  • He reports 500,000 IP addresses in 2 weeks

Timing Information

• Timing information dictates NTP accuracy
• Offset: how far your clock is off from your peer (slewing)
• Delay: how many ms to communicate with your peer
• Dispersion: bound on error in time
• Measure to your synchronization peer, or to root

Date Mean Median SD 1999 33ms 32ms 115ms 1997 186ms 118ms

Date Mean Median SD 1999 8.2ms 1.8ms 18ms 1997 28.7ms 20.1ms

Date Mean Median SD 1999 84ms 47ms 156ms 1994 150ms 170ms

Date Mean Median SD 1999 88ms 39ms 175ms 1994 150ms 250ms

Topological Information

• What does this network look like, anyway?
• Stratum 1 servers are overloaded
• Huge number of stratum 2 and 3 servers
• Long haul links are bad for accuracy

How Good is Internet Time?

• Everyone relies on stratum 1 servers
• Stratum 1 servers rely on hardware
• People don't administer this very carefully
• Some work on comparing multiple clocks
  • Sanity checks
  • Synthetic clocks
• How do you find a stratum 1 server?

Stratum 1 Quality

• Found 957 Stratum 1 clocks!
• But 638 are Local Clock drivers?!
• Only 80 of those 638 had good time
• 266 of 319 other stratum 1 clocks good
• Mills 97 found > 200 stratum 1 clocks

Summary

• 170,000 known servers, 650,000+ total hosts
• NTP topology hasn't changed much over time
• Delays and errors have gotten better
• Huge bottleneck at stratum 1 servers
• Need more multiple clock algorithms