[Ntp] Re: [EXT] [EXT] Focussing loop detection on loop detection only.
"Windl, Ulrich" <u.windl@ukr.de> Wed, 08 July 2026 10:57 UTC
Return-Path: <prvs=6424989cd=u.windl@ukr.de>
X-Original-To: ntp@mail2.ietf.org
Delivered-To: ntp@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6E342112E3C51 for <ntp@mail2.ietf.org>; Wed, 8 Jul 2026 03:57:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783508261; bh=E7RI4auGFaA4imzBG0vofxls/hpdYUzHFKs7UfogAxw=; h=From:To:Subject:Date:References:In-Reply-To; b=rX4mPFAS0LL1iBGRJUyMJoryM0Js7DnU11JRH3AgZqefwEVcjJejDJkncF1krGOkk dP8akHohc01ivtam7/5xyO8l0Vm/D7SHBNDMQ4ReZz/ex23xIZPjmyIIsRb1gZCh7h iGNPk8QLkAgfW9J56m9KX6X5wCk5ibdTxoyRcujM=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ukr.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7QMjLEUfN1WO for <ntp@mail2.ietf.org>; Wed, 8 Jul 2026 03:57:40 -0700 (PDT)
Received: from mail02.ukr.de (mail02.ukr.de [193.175.194.182]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C58BE112E3B9E for <ntp@ietf.org>; Wed, 8 Jul 2026 03:57:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ukr.de; i=@ukr.de; q=dns/txt; s=ukr; t=1783508257; x=1815044257; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=E7RI4auGFaA4imzBG0vofxls/hpdYUzHFKs7UfogAxw=; b=ICiIvmVd4g/H5uLiQoVVRvu2jZjyonujGomrNl6bHimnJIslG5QLIpaU yqm/hUiB7Mt+DQU6600f4Uv0tPApohR5FcWNoZoofxELEkjuha5x/mfAC 1FqCC1RC9/mdBneEs2D8cdpWRTT9B6SNzWpHxtihI0W2PQ/lHzk6d0fhY fbugsZhdG7tE3MVzwUO2HOHjADl2s1+uJVNWNN2ZjpMfcLKTnfmOQzyQP bjVYEg8xMArNwEcbJQDekv/xs2lK0josXN4pzBOOs0qJHPlghaRVgyk6/ YFAcyexlD0I1ZpENRRx5JvbXdH/osNEyY6WAjC3GldaB2lGTBU+5X2U4G Q==;
X-CSE-ConnectionGUID: l0YZ0IbzTD221X7eviipyg==
X-CSE-MsgGUID: /pard18GSUaEXPl5CdmEyw==
X-ThreatScanner-Verdict: Negative
X-IronPort-AV: E=McAfee;i="6800,10657,11840"; a="8860699"
X-IronPort-AV: E=Sophos;i="6.25,153,1779141600"; d="scan'208";a="8860699"
Received: from unknown (HELO ukr.de) ([172.24.2.105]) by dmz-infcsg02.ukr.dmz with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2026 12:57:36 +0200
Received: from ukr-excmb07.ukr.local (172.24.2.107) by ukr-excmb05.ukr.local (172.24.2.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Wed, 8 Jul 2026 12:57:34 +0200
Received: from ukr-excmb07.ukr.local ([fe80::4dee:3e0b:b33f:60ac]) by ukr-excmb07.ukr.local ([fe80::4dee:3e0b:b33f:60ac%8]) with mapi id 15.02.2562.043; Wed, 8 Jul 2026 12:57:34 +0200
From: "Windl, Ulrich" <u.windl@ukr.de>
To: David Venhoek <david=40venhoek.nl@dmarc.ietf.org>, NTP WG <ntp@ietf.org>
Thread-Topic: [EXT] [EXT] [Ntp] Focussing loop detection on loop detection only.
Thread-Index: AQHdDq8DMWwHsuAYF0Oqxhl3bSGV6LZjcpww
Date: Wed, 08 Jul 2026 10:57:34 +0000
Message-ID: <51c8db95f8434a0ba5c70e8a44e4e490@ukr.de>
References: <CAPz_-SUxrGMUy2UJ1vcfX5jb3FSHqXZ3VAuhwSfxTRMrbTj28g@mail.gmail.com>
In-Reply-To: <CAPz_-SUxrGMUy2UJ1vcfX5jb3FSHqXZ3VAuhwSfxTRMrbTj28g@mail.gmail.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [172.24.3.1]
x-tm-snts-smtp: 98EB73D347770D3222B5A05D7B3BBB966D39FFB0829ED7C50DE5E4A093AC9C272000:8
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Message-ID-Hash: 4YLJZPUMJ7ANMSFV36DQAVR3WO53UYTS
X-Message-ID-Hash: 4YLJZPUMJ7ANMSFV36DQAVR3WO53UYTS
X-MailFrom: prvs=6424989cd=u.windl@ukr.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ntp.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Ntp] Re: [EXT] [EXT] Focussing loop detection on loop detection only.
List-Id: Network Time Protocol <ntp.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/zNlMr7vAKTLdGNnYtVgHxbleRfo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Owner: <mailto:ntp-owner@ietf.org>
List-Post: <mailto:ntp@ietf.org>
List-Subscribe: <mailto:ntp-join@ietf.org>
List-Unsubscribe: <mailto:ntp-leave@ietf.org>
Hi! I'm missing the argument WHY it's possible to "remove the need for stratum 1 servers". For example a stratum-1 server using a DCF77 clock as reference may become a stratum-2 server during thunderstorms when the sender is switched off, or when receptions is barely possible. Kind regards, Ulrich Windl > -----Original Message----- > From: David Venhoek <david=40venhoek.nl@dmarc.ietf.org> > Sent: Wednesday, July 8, 2026 9:54 AM > To: NTP WG <ntp@ietf.org> > Subject: [EXT] [EXT] [Ntp] Focussing loop detection on loop detection only. > > > Hi All, > > As an alternative to Miroslav's weighted list idea for loop detection, > I want to propose we improve the capacity of the bloom filter by > removing a lot of the unnecessary sources from the bloom filter > itself. Removing the need for stratum 1 servers to put anything in the > bloom filter removes a large number of identifiers, reducing the > number of ids in miroslav's 5 strata example from 3906 back down to a > much more managable 626. > > The desire to provide information on where the time is coming from > primarily can be solved separately by including something similar (but > a bit more robust) to the ntpv4 reference id. This can provide > information on the primary source of the server, IF the server is > willing to share it. Making it optional allows servers which want to > have a more defensive posture to not provide such information without > having to mess with the loop detection mechanism and becoming > non-compliant. > > Patches to the specification providing these changes are included > below, and in the following PR on github: > https://github.com/ietf-wg-ntp/draft-ietf-ntp-ntpv5/pull/32 > > Kind regards, > David Venhoek > > >From 685bd47204650e2be7fc132de1d1c15fec9cb204 Mon Sep 17 00:00:00 > 2001 > From: David Venhoek <david@tweedegolf.com> > Date: Wed, 8 Jul 2026 09:18:08 +0200 > Subject: [PATCH 1/2] Remove information on non-ntpv5 sources from bloom > filter. > > This provides more room in the bloom filter for sources for which loop > detection is actually needed, extending the useful capacity of the > filter. > --- > ntp-ntpv5.xml | 14 +++++--------- > 1 file changed, 5 insertions(+), 9 deletions(-) > > diff --git a/ntp-ntpv5.xml b/ntp-ntpv5.xml > index 0c51aef..ead2c3d 100644 > --- a/ntp-ntpv5.xml > +++ b/ntp-ntpv5.xml > @@ -769,15 +769,11 @@ > sources selected for synchronization and the server's own reference > ID.</t> > > - <t>If the server uses a previous version of NTP for some of its > - sources, the reference IDs added to the filter are generated from > - their IP addresses as the first 120 bits of the > - <xref target="RFC1321">MD5</xref> sum of the address in network > - order. If the server uses a reference clock, the reference ID is the > - first 120 bits of the MD5 sum of the 4-octet zero-padded ASCII > - string from the NTP Reference Identifier Codes registry maintained by > - IANA, or a string beginning with the uppercase letter X, which are > - reserved for private and experimental use.</t> > + <t>Sources the server uses that are not using NTPv5 shall not > be included > + in the bloom filter. Furthermore, a server not considering any NTPv5 > + server as a potential source may choose to send an empty bloom filter > + to its clients. This provides more room in the bloom filter > for downstream > + clients, lowering the probability of false positives.</t> > > <t>A client checking whether the server's set of reference IDs contains > the client's own reference ID checks whether the bits at the 10 > -- > 2.47.3 > > >From 59095c3a611cea5791c6a10d25c1235f02302526 Mon Sep 17 00:00:00 > 2001 > From: David Venhoek <david@tweedegolf.com> > Date: Wed, 8 Jul 2026 09:19:15 +0200 > Subject: [PATCH 2/2] Provide an optional mechanism for indicating the > primary > time source. > > This allows servers to provide insight into what their primary source of > synchronization is, without having to use valuable space in the bloom > filter and without risks of false positives. > --- > ntp-ntpv5.xml | 97 > +++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 97 insertions(+) > > diff --git a/ntp-ntpv5.xml b/ntp-ntpv5.xml > index ead2c3d..608c349 100644 > --- a/ntp-ntpv5.xml > +++ b/ntp-ntpv5.xml > @@ -881,6 +881,56 @@ > to other NTP servers (i.e. they can be in a synchronization > loop).</t> > </section> > > + <section title="Primary Source Extension Field" > + anchor="primary-source-extension-field"> > + <t>This extension filed provides a method for clients to query a server > + about what its most important source of time > synchronization is. It consists > + of a Kind field describing the kind of identifier, together > with the actual > + value of the source identifier.</t> > + > + <t>The format of the Primary Source Extension Field is shown > in Figure <xref > + format="counter" target="primary-source-ext-field"/>.</t> > + > + <figure align="center" anchor="primary-source-ext-field" > + title="Format of Primary Source Extension Field"> > + <artwork><![CDATA[ > + 0 1 2 3 > + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 > ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ > +| Type = [[TBD]] (draft 0xF50A) | Length | > ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ > +| Kind | Reserved | | > ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + > +. . > +. Source Identifier (variable) . > +. . > ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ > + ]]></artwork> > + </figure> > + > + <t>The client requests information on the primary source of a server by > + including the Primary Source Extension Field in its > request, with special None kind (0) > + and a identifier 16 bytes long consisting of all 0s. The > dummy value is provided to > + ensure there is room for the identifier in the response > regardless of its kind.</t> > + > + <t>If supported by the server, and if the identifier is > shorter or equal in length to the > + None identifier provided by the client, the server SHALL > include a Primary Source Extension > + Field in its response containing the source identifier of > the source which most > + contributes to its estimate of the current time. The server > SHALL NOT send a Primary Source > + Extension Field in its response which is larger than the > Primary Source Extension Field in the > + client's request.</t> > + > + <t>If the servers primary source is an NTP source reached > over IpV4, it shall use the IpV4 kind (1) > + and provide the IpV4 address of the source as the source > identifier.</t> > + > + <t>If the servers primary source is an NTP source reached > over IpV6, it shall use the IpV6 kind (2) > + and provide the IpV6 address of the source as the source > identifier.</t> > + > + <t>If the servers primary source cannot reasonably be > described by any of the other kinds known to > + the server, it may use the NTP Reference Identifer kind > (3), and provide an entry from the IANA NTP Reference > + Identifier Codes table to describe the source.</t> > + </section> > + > <section title="Server Information Extension Field" > anchor="server-information-extension-field"> > <t>This field provides clients with information about which NTP > @@ -1732,6 +1782,10 @@ Tx | 0 | | t3'| | 0 | | t3 | > | 0 | |t11'| > <c>Reference IDs Request</c> > <c><xref target="reference-ids-extension-fields">[[this > memo]]</xref></c> > > + <c>[[TBD]]</c> > + <c>Primary Source</c> > + <c><xref target="primary-source-extension-field">[[this > memo]]</xref></c> > + > <c>[[TBD]]</c> > <c>Reference IDs Response</c> > <c><xref target="reference-ids-extension-fields">[[this > memo]]</xref></c> > @@ -1774,6 +1828,49 @@ Tx | 0 | | t3'| | 0 | | t3 | > | 0 | |t11'| > <c>Network Time Protocol version 5 (NTPv5)</c> > <c><xref target="network-time-security">[[this memo]]</xref></c> > </texttable> > + > + <t>IANA is requested to create a new registry entitled "Network Time > + Protocol Source Identifier Types". Its entries SHALL have the following > + fields: > + <list> > + <t>Number (REQUIRED): An integer in the range 0–255 > inclusive.</t> > + <t>Description (REQUIRED): A short text description of the > identifier type.</t> > + <t>Reference document (REQUIRED): A reference to the relevant > + specification document.</t> > + </list> > + The policy for allocation of new entries in this registry SHALL vary by > + their Number, as follows: > + <list> > + <t> 0–247: IETF Review</t> > + <t> 248–255: Private and Experimental Use</t> > + </list> > + </t> > + > + <t> The initial contents of the Network Time Protocol Source > Identifier Types > + Registry SHALL be as follows: > + </t> > + > + <texttable> > + <ttcol>Number</ttcol> > + <ttcol>Description</ttcol> > + <ttcol>Reference</ttcol> > + > + <c>0</c> > + <c>None</c> > + <c><xref target="primary-source-extension-field">[[this > memo]]</xref></c> > + > + <c>1</c> > + <c>IpV4</c> > + <c><xref target="primary-source-extension-field">[[this > memo]]</xref></c> > + > + <c>2</c> > + <c>IpV6</c> > + <c><xref target="primary-source-extension-field">[[this > memo]]</xref></c> > + > + <c>3</c> > + <c>NTP Reference Identifier</c> > + <c><xref target="primary-source-extension-field">[[this > memo]]</xref></c> > + </texttable> > </section> > > <section title="Implementation Status - RFC EDITOR: REMOVE BEFORE > PUBLICATION"> > -- > 2.47.3 > > _______________________________________________ > ntp mailing list -- ntp@ietf.org > To unsubscribe send an email to ntp-leave@ietf.org
- [Ntp] Focussing loop detection on loop detection … David Venhoek
- [Ntp] Re: [EXT] [EXT] Focussing loop detection on… Windl, Ulrich
- [Ntp] Re: [EXT] [EXT] Focussing loop detection on… Miroslav Lichvar
- [Ntp] Re: [EXT] Re: Re: [EXT] [EXT] Focussing loo… Windl, Ulrich
- [Ntp] Re: [EXT] [EXT] Focussing loop detection on… David Venhoek
- [Ntp] Re: [EXT] [EXT] Focussing loop detection on… Miroslav Lichvar
- [Ntp] Re: [EXT] Re: Re: [EXT] [EXT] Focussing loo… Hal Murray
- [Ntp] Re: [EXT] Re: Re: [EXT] Re: Re: [EXT] [EXT]… Windl, Ulrich
- [Ntp] Re: [EXT] Re: Re: [EXT] Re: Re: [EXT] [EXT]… Hal Murray
- [Ntp] Re: [EXT] Re: Re: [EXT] Re: Re: [EXT] [EXT]… Miroslav Lichvar
- [Ntp] Re: [EXT] Re: [EXT] Re: Re: [EXT] Re: Re: [… Windl, Ulrich
- [Ntp] Re: [EXT] Re: [EXT] Re: Re: [EXT] Re: Re: [… David Venhoek