Recent NTP pool traffic increase
blake at ispn.net
Thu Dec 15 23:00:27 UTC 2016
I would think if a service provider failed, the stats would bear that
out. For example, if one of the top ISPs in the world was forwarding
requests, then you would likely see an increase in the number of queries
generated from IP addresses registered to that organization. A similar
effect could occur if a large ISP recently started distributing NTP
servers as part of their DHCP options when they had not previously. If
historical query data is not available, the current data could be used
to make an educated guess and follow up on the likely data trails as
I would also not rule out the possibility that a Netgear, DLink,
T-mobile or some other vendor or distributor of access gear pushed out a
firmware update which enabled NTP when it previously was disabled or
otherwise changed a device's NTP settings or behavior.
Jose Gerardo Perales Soto wrote on 12/15/2016 4:45 PM:
> We've recently experienced a traffic increase on the NTP queries to NTP pool project (pool.ntp.org) servers. One theory is that some service provider NTP infraestructure failed approximately 2 days ago and traffic is now being redirected to servers belonging to the NTP pool project.
> Does anyone from the service provider community have any comments?
> Gerardo Perales
More information about the NANOG