The details of how it works are in the ntpq man page. Search for maxage or minage.
A server will end up operating in one of several modes, depending on the ratio of traffic and MRU table size. If the server has only a few clients, they each get a slot and they will stick around until ntpd is restarted. The default mindelth is 600 slots. The default table size is bigger than that. If you have a lot of clients and the table is big enough, the table will fill until some slots are older than maxage. Those slots will get recycled. The table will never get full. There may be slots older than maxage. They don't get recycled until needed. If you have a lot of clients but the table isn't big enough, slots won't make it to maxage. The oldest slot will get recycled when needed as long as it is older than minage. The table will be full. The oldest slot will be somewhere between minage and maxage. On systems with bigger tables the oldest slot will be nearer to maxage. If you have even more traffic, some traffic will go unmonitored. The table will be full. The oldest slot will be minage. Slots will get recycled as soon as they are old enough. Some traffic will not get monitored. ntpq monstats has been updated to show counters and the age of the oldest slot. Let's look at some numbers. Slots are roughly 100 bytes, so you get a million slots with 100 megabytes of memory. At 100 packets per second, assuming they all come from different addresses, it takes 10K seconds to fill up the table. A host can't be very abusive if it doesn't send at least 10 packets. So if all hosts are potentially abusive, it will take over a day to fill the table. I have some data. I'll have to make some histograms. -- These are my opinions. I hate spam. _______________________________________________ devel mailing list devel@ntpsec.org http://lists.ntpsec.org/mailman/listinfo/devel
