[Ntp] Microbursts of NTP packets

Watson Ladd <watsonbladd@gmail.com> Tue, 18 August 2020 01:20 UTC

Return-Path: <watsonbladd@gmail.com>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9158A3A1562 for <ntp@ietfa.amsl.com>; Mon, 17 Aug 2020 18:20:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jrc5cF9GqSG9 for <ntp@ietfa.amsl.com>; Mon, 17 Aug 2020 18:20:17 -0700 (PDT)
Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC5EB3A1560 for <ntp@ietf.org>; Mon, 17 Aug 2020 18:20:16 -0700 (PDT)
Received: by mail-lf1-x12b.google.com with SMTP id x24so9320275lfe.11 for <ntp@ietf.org>; Mon, 17 Aug 2020 18:20:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=F3wSLRvq2iTS6Bag1bQ+i283ww3MJ//7OlSJtNh9ZKA=; b=aCBARdgYE+m14TxxhNG3nnL4tGaw+MBtzz7790zFcWeiKe5z3yfSThyiCFowCxQ4Or SmCv6kFFqyFCiMej/In5H+3CxPHVgDddt25avMuuHtj3/1wrZMEUWNvBnvw7RZSAiArH ryGYAWvRObq7fg9N6pDnz24DAGcNQgc78VxXdc5gQJkFGxHxWHoS+kySN2dpnYPDkqRH PC4Jp74wbKoDOCnRAW6780RRfa5hGib/FVR2XjMdiOA7CR+bHZUvR5vEksoJBq+/4rLJ sVc6RE+Zv7TxDv3PUgCk8JdGANRteq2wHycoD2pXZnrujx2kygs4K2NA01hU4FgLJSvF ir7Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=F3wSLRvq2iTS6Bag1bQ+i283ww3MJ//7OlSJtNh9ZKA=; b=m7/7Aq8qvxl7Vo3vovLh3cKnhF1VxS+a3l/TCVOGazxYBaWoizhnIAPNICJoQlPGHZ e4bPdASJgpcn/NnAXJmmTj/C9SXv7Wji/Gz5IQiHTuihNvzzmxJZHY2puJzSXL5AqvlA UmJ2mYZnUfp2iOvkWQZCDOx0Q5GHOa0vSNJzzGr+WZi4j72eZU2yFmX3zJthO3q+FBCM eQjdehLzUNlfpR1oJfs3/pKuFntxkXrXpYMRHellFM/gxpug4iHkposQdmY26M21+QPO 6EhcWRcYUBkTcH38gmNgEc0IsHKs30rmAxkGLBFHpgqrYbNtH/Cu7r6FzQa4FxA803oT iTfw==
X-Gm-Message-State: AOAM531Lqx1gFiazNTZV63/YgfAGDS41mP0jgWFd3L2n1OjB0mmnk5OZ 7PAufZd6JtS0bwNzaF46re81GNUStvy5zb4la6R7qYdpvFw=
X-Google-Smtp-Source: ABdhPJw5fpjjRZe1QbNlas/Mjw6A/aPGmSLfERbWg0dRXMyvbWd5MM0e+WrjRbfLUFsFoZCvnkXXLdF27mNuIL4xg3k=
X-Received: by 2002:ac2:598f:: with SMTP id w15mr8696762lfn.216.1597713614387; Mon, 17 Aug 2020 18:20:14 -0700 (PDT)
MIME-Version: 1.0
From: Watson Ladd <watsonbladd@gmail.com>
Date: Mon, 17 Aug 2020 21:20:03 -0400
Message-ID: <CACsn0cm7PX-NzJBrA6RR_u=1c3PWjga8t+iccd3Am_VFsDWoKQ@mail.gmail.com>
To: NTP WG <ntp@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/lQqcKzHzd54apcB3dB-NQ2mBCr8>
Subject: [Ntp] Microbursts of NTP packets
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Aug 2020 01:20:19 -0000

Dear NTP WG,

We're observing short bursts of high numbers of NTP queries at one
point of presence, exceeding the queue length of the listening ntp
socket, and leading to drops. The bursts are very short, so the
overall qps is nothing special. I'm quite mystified as to what the
possible causes could be.

This is unfortunately leading to packet drops. If any operators have
seen this, their input on possible causes and solutions is welcome.

Sincerely,
Watson Ladd