r4 - 2013-09-20 - 23:14:08 - RahulKatareYou are here: NTP >  Dev Web > GoogleSummerOfCode > GSoC2013StartupAnalysisRahul > GSoC2013StartupAnalysisRahulDesign
NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38.

ntp-4.2.8p13 was released on 07 March 2019. It addresses 1 medium-severity security issue in ntpd, and provides 17 non-security bugfixes and 1 other improvements over 4.2.8p12.

Please see the NTP Security Notice for vulnerability and mitigation details.

Are you using Autokey in production? If so, please contact Harlan - he's got some questions for you.
Work Page

Initial Discussion

  • We have data from a single hosts, some 'p' no. of packets. Task is to find offset and drift(frequency).
  • One of the Idea to do this is to plot (ourtime, histime) where ourtime - Time at our machine, histime - time returned from the host ( which can be calculated from t1/t2/t3/t4 timestamps returned from the host).
  • If we fit a linear regression line in this plot, slope will give us the frequency estimate.
  • Another idea is to do a plot of (0, offset1), (1, offset2) .... and similar calculations can be done.
  • Wifi connections have more 'jitter', linear fit may not be the best option here, some thoughts need to be made in this area later.

For a Single Host : Estimating Drift

  • Method Description

In each of the method, we get some 'p' packets from a server each of which contains the "timestamp" data. We calculate the "offset" from the each of the data packets we recieve using the formula suggested in RFC. Then we plot a point for each packet using these data as suggested in Method 1 and Method 2 below. We then apply the Linear Regression Model because time advances linearly. We use the slope of the Regression Line as the Estimated Drift in each of the method.

    • Method 1 : Calculating Drift by plotting (0, offset0), (1, offset1) .... (n, offsetn)
    • Method 2 : Calculating Drift by plotting (ourtime0, histime0), (ourtime1, histime1) ... (ourtime n, histime n)
      • Here histime 'n' = ourtime 'n' + offset 'n'
  • Result for Host : psp-fb1
    • wait: 20; cushion: 0.400000; n_polls: 8; interval: 2.800000
      interval.tv_sec: 2; interval.tv_usec: 799999; diff: 0.000001
      Lookups handled
      Back from event_base_dispatch
      IPv4: 0x9d09bd8, 8 responses
      - 149.20.68.27
      - 1377716514.615145 offset +0.051773674, precision 0.000000954, SyncD 0.009681702, S 2
      - 1377716517.418472 offset +0.051778495, precision 0.000000954, SyncD 0.009704590, S 2
      - 1377716520.221756 offset +0.051792968, precision 0.000000954, SyncD 0.009727478, S 2
      - 1377716523.025024 offset +0.051719559, precision 0.000000954, SyncD 0.009742737, S 2
      - 1377716525.828313 offset +0.051751794, precision 0.000000954, SyncD 0.009757996, S 2
      - 1377716528.631621 offset +0.051789640, precision 0.000000954, SyncD 0.009780884, S 2
      - 1377716531.434865 offset +0.051729778, precision 0.000000954, SyncD 0.009803772, S 2
      - 1377716534.238257 offset +0.051719767, precision 0.000000954, SyncD 0.009826660, S 2
      Method 1 : Estimated Drift : -0.000007127
      Method 2 : Estimated Drift : 0.000000000
      IPv6: 0x9d0b388, 8 responses
      - (socktoa unknown family 34706)
      - 1377716514.615038 offset +0.051757523, precision 0.000000954, SyncD 0.009681702, S 2
      - 1377716517.418375 offset +0.051746220, precision 0.000000954, SyncD 0.009704590, S 2
      - 1377716520.221664 offset +0.051744052, precision 0.000000954, SyncD 0.009727478, S 2
      - 1377716523.025024 offset +0.051793136, precision 0.000000954, SyncD 0.009742737, S 2
      - 1377716525.828343 offset +0.051815339, precision 0.000000954, SyncD 0.009757996, S 2
      - 1377716528.631526 offset +0.051755251, precision 0.000000954, SyncD 0.009780884, S 2
      - 1377716531.434970 offset +0.051777499, precision 0.000000954, SyncD 0.009803772, S 2
      - 1377716534.238317 offset +0.051768721, precision 0.000000954, SyncD 0.009826660, S 2
      Method 1 : Estimated Drift : 0.000003459
      Method 2 : Estimated Drift : 0.003039514
  • Result for Host : psp-fb2
    • wait: 20; cushion: 0.400000; n_polls: 8; interval: 2.800000
      interval.tv_sec: 2; interval.tv_usec: 799999; diff: 0.000001
      Lookups handled
      Back from event_base_dispatch
      IPv4: 0x9c21bd8, 8 responses
      - 149.20.68.28
      - 1377716725.454970 offset +0.051814058, precision 0.000001907, SyncD 0.012725830, S 3
      - 1377716728.258269 offset +0.051830451, precision 0.000001907, SyncD 0.012748718, S 3
      - 1377716731.061638 offset +0.051796604, precision 0.000001907, SyncD 0.012771606, S 3
      - 1377716733.864923 offset +0.051785300, precision 0.000001907, SyncD 0.012794495, S 3
      - 1377716736.668215 offset +0.051801779, precision 0.000001907, SyncD 0.012817383, S 3
      - 1377716739.471623 offset +0.051833478, precision 0.000001907, SyncD 0.012832642, S 3
      - 1377716742.274970 offset +0.051812146, precision 0.000001907, SyncD 0.012855530, S 3
      - 1377716745.078193 offset +0.051823378, precision 0.000001907, SyncD 0.012878418, S 3
      Method 1 : Estimated Drift : 0.000001200
      Method 2 : Estimated Drift : -0.002941176
      IPv6: 0x9c23388, 8 responses
      - (socktoa unknown family 34706)
      - 1377716725.455035 offset +0.051861892, precision 0.000001907, SyncD 0.012725830, S 3
      - 1377716728.258332 offset +0.051879908, precision 0.000001907, SyncD 0.012748718, S 3
      - 1377716731.061638 offset +0.051866994, precision 0.000001907, SyncD 0.012771606, S 3
      - 1377716733.864923 offset +0.051863642, precision 0.000001907, SyncD 0.012794495, S 3
      - 1377716736.668215 offset +0.051875379, precision 0.000001907, SyncD 0.012817383, S 3
      - 1377716739.471685 offset +0.051915173, precision 0.000001907, SyncD 0.012832642, S 3
      - 1377716742.274970 offset +0.051891474, precision 0.000001907, SyncD 0.012855530, S 3
      - 1377716745.078255 offset +0.051879093, precision 0.000001907, SyncD 0.012878418, S 3
      Method 1 : Estimated Drift : 0.000003982
      Method 2 : Estimated Drift : 0.002941176

  • The hosts from which we get the time data, coordinate among themselves to maintain correct time, also from the servers at the top level of the strata hierarchy. So the data which we get from these hosts the majority of them must correlate among themselves. So we need to identify servers that correlate among themselves. These servers are expected to provide good quality data.

  • I would like to stress that Method 1 may not be best way to extract information from the data. The reason being that it assumes that offset come at equal spaced 'x' points, which is not correct as offsets arrive at different time intervals. So Method 1 may not solve our purpose. Hence in future discussions we dropped that.

  • To make method 1 work we follow a different kind of approach. We subtract the "last X value" from all other X - values, then add the respective offsets to obtain the Y value. This overcomes the hurdle we face in Method 1 where we wanted to put offsets at the time which appear.

  • Hence the Modified Method 1:
    • Data Interpolated
      -------------------------
      Ourtime Histime

      -19.623096 -19.624713
      -16.601631 -16.603281
      -14.016695 -14.018369
      -11.213178 -11.214816
      -8.412213 -8.413817
      -5.608624 -5.610261
      -2.449951 -2.451568
      0.000000 -0.001585
      -------------------------
      Slope : 1.000002
      Drift : 2.249573e-06
      Intercept : -0.001606
      Correlation : 1.000000
  • At the current Data-Evaluation framework which I have built, there is scope for Error Analysis in the Linear Regression we are applying through various methods. The link to my data analysis framework is here Data Analysis Framework .

-- RahulKatare - 2013-06-08

Edit | WYSIWYG | Attach | Printable | Raw View | Backlinks: Web, All Webs | History: r4 < r3 < r2 < r1 | More topic actions
 
SSL security by CAcert
Get the CAcert Root Certificate
This site is powered by the TWiki collaboration platform
IPv6 Ready
Copyright & 1999-2019 by the contributing authors. All material on this collaboration platform is the property of the contributing authors. Ideas, requests, problems regarding the site? Send feedback