Recent NTP pool traffic increase

Blake Hudson blake at
Thu Dec 15 23:00:27 UTC 2016

I would think if a service provider failed, the stats would bear that 
out. For example, if one of the top ISPs in the world was forwarding 
requests, then you would likely see an increase in the number of queries 
generated from IP addresses registered to that organization. A similar 
effect could occur if a large ISP recently started distributing NTP 
servers as part of their DHCP options when they had not previously. If 
historical query data is not available, the current data could be used 
to make an educated guess and follow up on the likely data trails as 
currently visible.

I would also not rule out the possibility that a Netgear, DLink, 
T-mobile or some other vendor or distributor of access gear pushed out a 
firmware update which enabled NTP when it previously was disabled or 
otherwise changed a device's NTP settings or behavior.


Jose Gerardo Perales Soto wrote on 12/15/2016 4:45 PM:
> Hi,
> We've recently experienced a traffic increase on the NTP queries to NTP pool project ( servers. One theory is that some service provider NTP infraestructure failed approximately 2 days ago and traffic is now being redirected to servers belonging to the NTP pool project.
> Does anyone from the service provider community have any comments?
> Gerardo Perales

More information about the NANOG mailing list