Adrian von Bidder wrote:
On Sunday 24 August 2008 00.59:15 Nelson Minar wrote:
I'm in the process of moving my little NTP server, so I went and took a
look back at my stats I've been tracking. You can see them here:
http://www.somebits.com/ntp/one%20year.html
Could you recreate the unique IP plot with a bigger window (1200 seconds?)
to catch ntp at its default setting of sending one packet per 1024 seconds?
You're counting those as unique IP in your plot, or am I misinterpreting?
What my "unique IPs per second" is showing is, on average, how many
unique IP addresses I see every second. But I'm "forgetting" an IP
address every 10 minutes. That's not a great match to NTP's behavior of
one request / 17 minutes for well behaved clients and I'm probably
undercounting unique clients in my graph. Another way to look at it is
in 10 minutes I see 8 IPs / second * 600 seconds = 4800 IPs. The true
count of clients is probably close to double that, so I guess I'm
serving time to roughly 10,000 unique clients.
(Why a 10 minute window? Because the graph I really care about is insane
clients, the 3rd graph of clients who send 20 requests in 10 minutes.
For some reason I thought a window shorter than the 17 minute proper NTP
would help catch them, although now I can't reconstruct why).
I really do log a timestamp and IP address for every single NTP request
my server gets. If someone wants to do further research, I'm happy to
provide the data.
Me, I'm content to look at the trends. Roughly double the number of
clients in a year with no worrying increase in insane / abusive client
percentage.
_______________________________________________
timekeepers mailing list
[email protected]
https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
