On 11/21/2012 03:50 AM, Bob Smither wrote:
Anyone notice this?:
https://isc.sans.edu/diary.html?n&storyid=14548
Seems a Navy NTP server claimed it was year 2000 for a while.
Qouted message:
8<---
Sent: Tuesday, 20 November, 2012 09:38
To: na...@nanog.org
Subject: Re: NTP Issues Today
In a message written on Mon, Nov 19, 2012 at 04:21:55PM -0700, Van Wolfe
wrote:
> Did anyone else experience issues with NTP today? We had our server
> times update to the year 2000 at around 3:30 MT, then revert back to
2012.
I'm surprised the various time geeks aren't all posting their logs, so
I'll kick off:
/tmp/parse-peerstats.pl peerstats.20121119
56250 76367.354 192.5.41.41 91b4 -378691200.312258363 0.088274002
0.014835425 0.263515353
56250 77391.354 192.5.41.41 91b4 -378691200.312258363 0.088274002
0.018668790 0.263749719
56250 78204.354 192.5.41.40 90b4 -378691200.785377324 0.088179350
0.014812585 0.263668835
56250 78416.355 192.5.41.41 91b4 -378691200.785974681 0.088312507
0.014832943 0.209966600
56250 79229.355 192.5.41.40 90b4 -378691200.785377324 0.088179350
0.018668723 378691200.785523713
56250 79442.355 192.5.41.41 91b4 -378691200.785974681 0.088312507
0.018689918 378691200.786114931
Or in more human readable form:
/tmp/parse-peerstats.pl peerstats.20121119
192.5.41.41 off by -378691200.312258363
192.5.41.41 off by -378691200.312258363
192.5.41.40 off by -378691200.785377324
192.5.41.41 off by -378691200.785974681
192.5.41.40 off by -378691200.785377324
192.5.41.41 off by -378691200.785974681
The script, if you want to run against your own stats:
#!/usr/bin/perl
while (<>) {
chomp;
($day, $second, $addr, $status, $offset, $delay, $disp, $skew) = split;
if (($offset > 10) || ($offset < -10)) {
# print "$addr off by $offset\n"; # More human friendly
print "$_\n"; # Full details
}
}
It just looks for servers off by more than 10 seconds and then prints
the line. 378691200 seconds is ~12 years, which lines up with the
year 2000 dates some are reporting.
The IP's are tick.usno.navy.mil and tock.usno.navy.mil.
I can confirm from my vantage point that tick and tock both went about
12 years wrong on Nov 19th for a bit, I can also report that my NTP
server with sufficient sources correctly determined they were haywire
and ignored them.
If your machines switched dates yesterday it probably means you're
NTP infrastructure is insufficiently peered and diversified.
--->8
378691200 s = 6311520 min = 105192 h = 4383 d = 12 y
When using the average length of year for the period, 365,25 days, you
realize it moved back exactly 12 years. So, for a while the YY code was
00 rather than 12. Possibly an error in their IRIG-B link.
It was a common mode error to both servers. It's worth nothing that even
a high-ranked clock house like USNO can have these errors so trusting
the one and true server can fail greatly. NTP by it's design has methods
to handle these kind of errors given sufficient many refences, where as
for example PTP always trust its server. If USNO would have had multiple
(different) time-links to their servers they could have potentially
mittigated this before it hit the server time.
Cheers,
Magnus
_______________________________________________
time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.
