> Yeah, in particular ones that are not at midnight local time (seen > from the user). :-) Well, even those would be interesting I guess -- > what I am going for is to find out if Big Corps are using the pool (in > particular if they are in a braiddead ever midnight way) and - in > particular - if DNS caching at big ISPs is significantly affecting the > distribution of requests to the pool.
Got it. I'm fairly certain the spikes on-the-hour are not a result of DNS caching. I'm guessing some NTP client or cron job just refreshes the client then. If we really needed to know, the way to figure this out would be to probe the OS of the hosts making the requests on the hour, and/or try to classify the NTP implementation based on packet captures. More work than I want to do for what's just an amusing puzzle. FWIW, yesterday I saw big spikes at 16:00, 17:00, 00:00, 06:00, 10:00, and 12:00. (Timezone is UTC). I have no explanation as to why there's not a spike every hour; maybe it has to do with whether I'm in the DNS rotation? The other time I looked a few days ago there were spikes at 22:00, 23:00, and 01:00, so not the same time of day every day. That's all consistent with some major pool consuming client waking up on the hour, resolving ntp.pool.org, and asking for the time. _______________________________________________ timekeepers mailing list [email protected] https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
