Darrin Chandler wrote: > On Thu, Aug 28, 2008 at 08:10:33AM -0700, Nelson Minar wrote: >>> Yeah, in particular ones that are not at midnight local time (seen >>> from the user). :-) Well, even those would be interesting I guess -- >>> what I am going for is to find out if Big Corps are using the pool (in >>> particular if they are in a braiddead ever midnight way) and - in >>> particular - if DNS caching at big ISPs is significantly affecting the >>> distribution of requests to the pool. >> Got it. I'm fairly certain the spikes on-the-hour are not a result of >> DNS caching. I'm guessing some NTP client or cron job just refreshes the >> client then. If we really needed to know, the way to figure this out >> would be to probe the OS of the hosts making the requests on the hour, >> and/or try to classify the NTP implementation based on packet captures. >> More work than I want to do for what's just an amusing puzzle. > > Wouldn't http://lcamtuf.coredump.cx/p0f.shtml make that simple? No > outbound probing involved. > > >
http://www.sourcefire.com/products/3D/rna It is not designed for it but should be able to provide a fair amount of information without probing. I could possibly make it available for a short period of time, if there is interest in giving it a try. I could also set up a dedicated server for rotation in and out of the pool from my lab here and run it providing the stats. _______________________________________________ timekeepers mailing list [email protected] https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
