Hello Anssi
On 30.07.2012 22:21, Anssi Johansson wrote:
I believe the proper way to estimate the average request rate is to
estimate the total volume of requests for .tr and sum up all the
bandwidth figures of all the servers serving .tr, and divide the traffic
among the servers based on the bandwidth (weight) of the servers.
My guesstimate for the total volume of requests is around 3800/sec
(based on [1] and [2]) and the sum of bandwidth of all the servers
serving .tr is probably something like 7000Mbps now (counting both my
IPs even though only one of them is now in the pool, see below for more).
That means for every 100Mbps, you should be getting around 54pps
(3800*100/7000) on average. This is a ballpark figure, the actual values
can vary quite a bit.
They do, even if my bandwidth for the pool is set to 10 Mbit/s, I
got at least one peak with 108'000 packets / minute (1800 packets
/ second), see e.g. [1]. The average is at 14'000 packets /
minute (233 packets / second), and those it is a lot more what
any calculation based on the assigned bandwidth would suggest.
Also my other two servers [2], [3] have this peaks. It is even
visible in my network traffic [4] (since Monday, logarithmic
graph), which does correspond to the ntp requests for the same
period [5].
[1] http://www.home4u.ch/ntp/ntp1.home4u.ch.html
[2] http://www.home4u.ch/ntp/ntp2.home4u.ch.html
[3] http://www.home4u.ch/ntp/ntp3.home4u.ch.html
[4] http://www.home4u.ch/mrtg/week.html
[5] http://www.home4u.ch/ntp/week.html
However, the "average" is the important word here as there will be
traffic bursts. The traffic bursts will only become less frequent when
more servers are added, but it won't reduce the peak values. This is
because most traffic from Turkey originates from SNTP clients which
resolve the NTP server's IP every time the pool is queried, ie. unlike
ntpd which only resolves the hostname once and keeps using that IP
address until ntpd is restarted. Another concern is that I think the
offending Turk Telekom CPE is using only pool.ntp.org, not any of the
subdomains [0-3].pool.ntp.org. The traffic would be spread more evenly
if the [0-3] subdomains were used.
This seems to be the thing which happens here, a lot of devices
resolve through the same DNS server and then use the same
(locally cached) IP address to query the ntp pool server. This
then hits also servers with low bandwidth with the same amount of
peak requests as other servers set to higher bandwidth.
Two questions regarding this.
First, did anybody try to contact Turk Telekom regarding this
behavior of their CPE? Eventually this are managed ADSL / VDSL
routers, which they give to their customers, but are still able
to change configurations (or update firmware). If I am correct,
some other ISPs in Europe do this.
Second, it would probably reduce the single peaks on a server, if
the TTL of 390 seconds (6.5 minutes) would be reduces. Is this
doable, or will this generate to much load on the Pool DNS
servers? This will probably only affect requests from sntp
clients, or in case of Turk Telekom only the requests from their
resolving DNS server. Regular ntpd will not resolve that often.
bye
Fabian
_______________________________________________
pool mailing list
[email protected]
http://lists.ntp.org/listinfo/pool
