Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is my NTP server costing $500 per year? Part 1 (2014)

blog.pivotal.io

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#61

Post by snuxoll »

raverbashing wrote: post #51
spydum wrote: post #26

Earlier quoted context omitted.

Virtualization and time sync have had notorious problems. One ugly work around was frequent NTP polling and adjustments. NTP has a min and max poll interval, and it determines how frequently it should poll automatically based on how far it sees drift happening. If it drifts pretty fast, it will quickly gravitate to the minpoll value, which is exactly what they show in their first graph: tons of polling at the minfreq…

I wonder, should this be solved with local NTP servers that resolve from the name pool.ntp.org?

Most corporate environments have long defaulted to having a strata 2 NTP server, as long as they use Windows since Kerberos requires clocks to be roughly in sync.

With the advent of the cloud I see a lot of businesses forgoing any central IdM solution like AD or IPA and as a result don't tend to have an NTP server unless they explicitly configured one.

All of my servers are joined to an AD or IPA domain, so they all use my local NTP servers by default.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#62

Post by X-Istence »

simtel20 wrote: post #40
cmrx64 wrote: post #33

Earlier quoted context omitted.

I had the same thought. Does the world really need another (presumably) stratum-3 server running in Amazon's cluster, when Amazon already runs a pool of stratum-2 servers? ([0-3].amazon.pool.ntp.org).

By my recent reading of the AWS docs, those pool addresses are not run by Amazon. They are DNS names that allow NTP load from AWS to the NTP pool to be distributed more fairly.

It's a vendor zone, anyone can register for a vendor zone...

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#63

Post by dfc »

brian_cunnie wrote: post #47
rincebrain wrote: post #8

Earlier quoted context omitted.

I wish he'd explained somewhere how they leapt to examining virtualized NTP clients, or what they ultimately did (since there's no part 3 that I can find).

[author] > I wish he'd explained somewhere how they leapt to examining virtualized NTP clients... I had a hunch [wrongly] that the traffic was caused by a particular operating system. I didn't have enough machines to run the tests on bare-metal, so I virtualized them. And I suspected that virtualization would provide a worst-case scenario (the virtualized clocks would be jittery). My big surprise was that Windows was…

I have never understood why people think kod is a useful setting. Why do you think a misbehaving/improperly configured client is going to honor the kod packet? The kod packet helps with some clients but I have never seen it change the behavior of the most egregious abusers. Just ignore future requests from misbehaving clients, there is not a lot of benefit in saying "please stop misbehaving" to a client that does not follow the spec.

Your configuration is lacking a number two big best practices. The most glaring is that you really need to add 'iburst' to your server stanzas. After that you should think about adjust minsane and minclock.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#64

Post by brian_cunnie »

z92 wrote: post #32
johansch wrote: post #23

Because you use AWS and they charge insane fees for outgoing bandwidth.

This $500 would have been $60, on a Digital Ocean box. DO has 1 TB/month limit. Their usage was 300 GB/month.

[author]

Digital Ocean is a great deal! Thanks for pointing that out.

The reason I use {aws,azure,google} to host my NTP servers is that my day job is developing a VM orchestrator (BOSH) for Cloud Foundry, and BOSH doesn't support Digital Ocean yet (AFAIK). But that's a personal choice, and an admittedly expensive one.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#65

Post by mitchty »

detaro wrote: post #44
late2part wrote: post #34

Earlier quoted context omitted.

Not really. If an NTP client gets 1/10th of the updates that it wants, it will still keep reasonably good time.

Do NTP clients not retry immediately/very quickly if a request gets lost?

Retry yes, immediately/very quickly no. Ntp is designed to handle network issues transparently.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#66

Post by duaneb »

Elrac wrote: post #12
zump wrote: post #10

Earlier quoted context omitted.

How is that even legal?

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic. IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

Wow, I never realized operators couldn't push fixes to their routers without permission. The internet is indeed a tragedy of the commons: trivial to ruin, but a Sisyphean task to fix.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#67

Post by foota »

mitchty wrote: post #65
detaro wrote: post #44

Earlier quoted context omitted.

Do NTP clients not retry immediately/very quickly if a request gets lost?

Retry yes, immediately/very quickly no. Ntp is designed to handle network issues transparently.

This was one of the issues wth netgears client, it retried every second until it worked.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#68

Post by Animats »

This is the Snapchat bug reported yesterday, right?

Incidentally, how is AWS dealing with the leap second next week? Google is going to have their time servers start to run fast around 20 minutes in advance of the leap second, so they're back in sync at 00:00:60 UTC.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#69

Post by feld »

zamfi wrote: post #46
agumonkey wrote: post #25

Earlier quoted context omitted.

Can't the university throttle non local connections ? (netgear could have provided the hardware ;)

Not necessary -- fortunately these routers all used source port 23457 for their NTP packets, making them trivially easy to block. I do recommend reading the incident report posted above if you have an interest in network operations, it's quite interesting!

You still have to receive the traffic to block it.
Post reply on HN