When we talk about "insane" or "broken" clocks, the context is important. What we are really talking about is what we call a "falseticker", that is, a clock that does not have the actual time in the range of its offset plus or minus its dispersion. So, with that definition the amount by which it is "broken" could be very small, in the range of milliseconds. Obviously, any clock that is further off than the tolerance for error that your particular application has is going to be a problem. If your tolerance is tighter than the range of dispersions of your "truechimer" servers, then you will not be able to reach your goal. If the tolerance is in the range, then any server that moves your idea of the time outside the range is a problem and "broken" as far as you are concerned.
As we saw before, the key is "independent" servers. We saw before that 4 servers is not enough to counter the failure of two servers if the two servers are either not independent or happen to fail in the same manner. In the same token, 3 servers are not enough to counter even a single failure if the failure is in the right range. That is the real reason for having four servers, not so that you will have three left after the failure. Three is just not enough to outvote certain types of single server failures. Brian Utterback _______________________________________________ questions mailing list questions@lists.ntp.org http://lists.ntp.org/listinfo/questions
