[Ntp] Re: [EXT] [EXT] Focussing loop detection on loop detection only.

"Windl, Ulrich" <u.windl@ukr.de> Wed, 08 July 2026 10:57 UTC

Return-Path: <prvs=6424989cd=u.windl@ukr.de>
X-Original-To: ntp@mail2.ietf.org
Delivered-To: ntp@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6E342112E3C51 for <ntp@mail2.ietf.org>; Wed, 8 Jul 2026 03:57:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783508261; bh=E7RI4auGFaA4imzBG0vofxls/hpdYUzHFKs7UfogAxw=; h=From:To:Subject:Date:References:In-Reply-To; b=rX4mPFAS0LL1iBGRJUyMJoryM0Js7DnU11JRH3AgZqefwEVcjJejDJkncF1krGOkk dP8akHohc01ivtam7/5xyO8l0Vm/D7SHBNDMQ4ReZz/ex23xIZPjmyIIsRb1gZCh7h iGNPk8QLkAgfW9J56m9KX6X5wCk5ibdTxoyRcujM=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ukr.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7QMjLEUfN1WO for <ntp@mail2.ietf.org>; Wed, 8 Jul 2026 03:57:40 -0700 (PDT)
Received: from mail02.ukr.de (mail02.ukr.de [193.175.194.182]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C58BE112E3B9E for <ntp@ietf.org>; Wed, 8 Jul 2026 03:57:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ukr.de; i=@ukr.de; q=dns/txt; s=ukr; t=1783508257; x=1815044257; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=E7RI4auGFaA4imzBG0vofxls/hpdYUzHFKs7UfogAxw=; b=ICiIvmVd4g/H5uLiQoVVRvu2jZjyonujGomrNl6bHimnJIslG5QLIpaU yqm/hUiB7Mt+DQU6600f4Uv0tPApohR5FcWNoZoofxELEkjuha5x/mfAC 1FqCC1RC9/mdBneEs2D8cdpWRTT9B6SNzWpHxtihI0W2PQ/lHzk6d0fhY fbugsZhdG7tE3MVzwUO2HOHjADl2s1+uJVNWNN2ZjpMfcLKTnfmOQzyQP bjVYEg8xMArNwEcbJQDekv/xs2lK0josXN4pzBOOs0qJHPlghaRVgyk6/ YFAcyexlD0I1ZpENRRx5JvbXdH/osNEyY6WAjC3GldaB2lGTBU+5X2U4G Q==;
X-CSE-ConnectionGUID: l0YZ0IbzTD221X7eviipyg==
X-CSE-MsgGUID: /pard18GSUaEXPl5CdmEyw==
X-ThreatScanner-Verdict: Negative
X-IronPort-AV: E=McAfee;i="6800,10657,11840"; a="8860699"
X-IronPort-AV: E=Sophos;i="6.25,153,1779141600"; d="scan'208";a="8860699"
Received: from unknown (HELO ukr.de) ([172.24.2.105]) by dmz-infcsg02.ukr.dmz with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2026 12:57:36 +0200
Received: from ukr-excmb07.ukr.local (172.24.2.107) by ukr-excmb05.ukr.local (172.24.2.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Wed, 8 Jul 2026 12:57:34 +0200
Received: from ukr-excmb07.ukr.local ([fe80::4dee:3e0b:b33f:60ac]) by ukr-excmb07.ukr.local ([fe80::4dee:3e0b:b33f:60ac%8]) with mapi id 15.02.2562.043; Wed, 8 Jul 2026 12:57:34 +0200
From: "Windl, Ulrich" <u.windl@ukr.de>
To: David Venhoek <david=40venhoek.nl@dmarc.ietf.org>, NTP WG <ntp@ietf.org>
Thread-Topic: [EXT] [EXT] [Ntp] Focussing loop detection on loop detection only.
Thread-Index: AQHdDq8DMWwHsuAYF0Oqxhl3bSGV6LZjcpww
Date: Wed, 08 Jul 2026 10:57:34 +0000
Message-ID: <51c8db95f8434a0ba5c70e8a44e4e490@ukr.de>
References: <CAPz_-SUxrGMUy2UJ1vcfX5jb3FSHqXZ3VAuhwSfxTRMrbTj28g@mail.gmail.com>
In-Reply-To: <CAPz_-SUxrGMUy2UJ1vcfX5jb3FSHqXZ3VAuhwSfxTRMrbTj28g@mail.gmail.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [172.24.3.1]
x-tm-snts-smtp: 98EB73D347770D3222B5A05D7B3BBB966D39FFB0829ED7C50DE5E4A093AC9C272000:8
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Message-ID-Hash: 4YLJZPUMJ7ANMSFV36DQAVR3WO53UYTS
X-Message-ID-Hash: 4YLJZPUMJ7ANMSFV36DQAVR3WO53UYTS
X-MailFrom: prvs=6424989cd=u.windl@ukr.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ntp.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Ntp] Re: [EXT] [EXT] Focussing loop detection on loop detection only.
List-Id: Network Time Protocol <ntp.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/zNlMr7vAKTLdGNnYtVgHxbleRfo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Owner: <mailto:ntp-owner@ietf.org>
List-Post: <mailto:ntp@ietf.org>
List-Subscribe: <mailto:ntp-join@ietf.org>
List-Unsubscribe: <mailto:ntp-leave@ietf.org>

Hi!

I'm missing the argument WHY it's possible to "remove the need for stratum 1 servers".
For example a stratum-1 server using a DCF77 clock as reference may become a stratum-2 server during thunderstorms when the sender is switched off, or when receptions is barely possible.

Kind regards,
Ulrich Windl

> -----Original Message-----
> From: David Venhoek <david=40venhoek.nl@dmarc.ietf.org>
> Sent: Wednesday, July 8, 2026 9:54 AM
> To: NTP WG <ntp@ietf.org>
> Subject: [EXT] [EXT] [Ntp] Focussing loop detection on loop detection only.
> 
> 
> Hi All,
> 
> As an alternative to Miroslav's weighted list idea for loop detection,
> I want to propose we improve the capacity of the bloom filter by
> removing a lot of the unnecessary sources from the bloom filter
> itself. Removing the need for stratum 1 servers to put anything in the
> bloom filter removes a large number of identifiers, reducing the
> number of ids in miroslav's 5 strata example from 3906 back down to a
> much more managable 626.
> 
> The desire to provide information on where the time is coming from
> primarily can be solved separately by including something similar (but
> a bit more robust) to the ntpv4 reference id. This can provide
> information on the primary source of the server, IF the server is
> willing to share it. Making it optional allows servers which want to
> have a more defensive posture to not provide such information without
> having to mess with the loop detection mechanism and becoming
> non-compliant.
> 
> Patches to the specification providing these changes are included
> below, and in the following PR on github:
> https://github.com/ietf-wg-ntp/draft-ietf-ntp-ntpv5/pull/32
> 
> Kind regards,
> David Venhoek
> 
> >From 685bd47204650e2be7fc132de1d1c15fec9cb204 Mon Sep 17 00:00:00
> 2001
> From: David Venhoek <david@tweedegolf.com>
> Date: Wed, 8 Jul 2026 09:18:08 +0200
> Subject: [PATCH 1/2] Remove information on non-ntpv5 sources from bloom
>  filter.
> 
> This provides more room in the bloom filter for sources for which loop
> detection is actually needed, extending the useful capacity of the
> filter.
> ---
>  ntp-ntpv5.xml | 14 +++++---------
>  1 file changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/ntp-ntpv5.xml b/ntp-ntpv5.xml
> index 0c51aef..ead2c3d 100644
> --- a/ntp-ntpv5.xml
> +++ b/ntp-ntpv5.xml
> @@ -769,15 +769,11 @@
>            sources selected for synchronization and the server's own reference
>            ID.</t>
> 
> -        <t>If the server uses a previous version of NTP for some of its
> -          sources, the reference IDs added to the filter are generated from
> -          their IP addresses as the first 120 bits of the
> -          <xref target="RFC1321">MD5</xref> sum of the address in network
> -          order. If the server uses a reference clock, the reference ID is the
> -          first 120 bits of the MD5 sum of the 4-octet zero-padded ASCII
> -          string from the NTP Reference Identifier Codes registry maintained by
> -          IANA, or a string beginning with the uppercase letter X, which are
> -          reserved for private and experimental use.</t>
> +        <t>Sources the server uses that are not using NTPv5 shall not
> be included
> +          in the bloom filter. Furthermore, a server not considering any NTPv5
> +          server as a potential source may choose to send an empty bloom filter
> +          to its clients. This provides more room in the bloom filter
> for downstream
> +          clients, lowering the probability of false positives.</t>
> 
>          <t>A client checking whether the server's set of reference IDs contains
>            the client's own reference ID checks whether the bits at the 10
> --
> 2.47.3
> 
> >From 59095c3a611cea5791c6a10d25c1235f02302526 Mon Sep 17 00:00:00
> 2001
> From: David Venhoek <david@tweedegolf.com>
> Date: Wed, 8 Jul 2026 09:19:15 +0200
> Subject: [PATCH 2/2] Provide an optional mechanism for indicating the
> primary
>  time source.
> 
> This allows servers to provide insight into what their primary source of
> synchronization is, without having to use valuable space in the bloom
> filter and without risks of false positives.
> ---
>  ntp-ntpv5.xml | 97
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 97 insertions(+)
> 
> diff --git a/ntp-ntpv5.xml b/ntp-ntpv5.xml
> index ead2c3d..608c349 100644
> --- a/ntp-ntpv5.xml
> +++ b/ntp-ntpv5.xml
> @@ -881,6 +881,56 @@
>            to other NTP servers (i.e. they can be in a synchronization
> loop).</t>
>        </section>
> 
> +      <section title="Primary Source Extension Field"
> +          anchor="primary-source-extension-field">
> +        <t>This extension filed provides a method for clients to query a server
> +          about what its most important source of time
> synchronization is. It consists
> +          of a Kind field describing the kind of identifier, together
> with the actual
> +          value of the source identifier.</t>
> +
> +        <t>The format of the Primary Source Extension Field is shown
> in Figure <xref
> +          format="counter" target="primary-source-ext-field"/>.</t>
> +
> +        <figure align="center" anchor="primary-source-ext-field"
> +            title="Format of Primary Source Extension Field">
> +          <artwork><![CDATA[
> + 0                   1                   2                   3
> + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
> ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> +| Type = [[TBD]] (draft 0xF50A) |             Length            |
> ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> +|      Kind     |    Reserved   |                               |
> ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
> +.                                                               .
> +.                   Source Identifier (variable)                .
> +.                                                               .
> ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> +          ]]></artwork>
> +        </figure>
> +
> +        <t>The client requests information on the primary source of a server by
> +          including the Primary Source Extension Field in its
> request, with special None kind (0)
> +          and a identifier 16 bytes long consisting of all 0s. The
> dummy value is provided to
> +          ensure there is room for the identifier in the response
> regardless of its kind.</t>
> +
> +        <t>If supported by the server, and if the identifier is
> shorter or equal in length to the
> +          None identifier provided by the client, the server SHALL
> include a Primary Source Extension
> +          Field in its response containing the source identifier of
> the source which most
> +          contributes to its estimate of the current time. The server
> SHALL NOT send a Primary Source
> +          Extension Field in its response which is larger than the
> Primary Source Extension Field in the
> +          client's request.</t>
> +
> +        <t>If the servers primary source is an NTP source reached
> over IpV4, it shall use the IpV4 kind (1)
> +          and provide the IpV4 address of the source as the source
> identifier.</t>
> +
> +        <t>If the servers primary source is an NTP source reached
> over IpV6, it shall use the IpV6 kind (2)
> +          and provide the IpV6 address of the source as the source
> identifier.</t>
> +
> +        <t>If the servers primary source cannot reasonably be
> described by any of the other kinds known to
> +          the server, it may use the NTP Reference Identifer kind
> (3), and provide an entry from the IANA NTP Reference
> +          Identifier Codes table to describe the source.</t>
> +      </section>
> +
>        <section title="Server Information Extension Field"
>            anchor="server-information-extension-field">
>          <t>This field provides clients with information about which NTP
> @@ -1732,6 +1782,10 @@ Tx  | 0  |    | t3'|      | 0  |    | t3 |
> | 0  |    |t11'|
>          <c>Reference IDs Request</c>
>          <c><xref target="reference-ids-extension-fields">[[this
> memo]]</xref></c>
> 
> +        <c>[[TBD]]</c>
> +        <c>Primary Source</c>
> +        <c><xref target="primary-source-extension-field">[[this
> memo]]</xref></c>
> +
>          <c>[[TBD]]</c>
>          <c>Reference IDs Response</c>
>          <c><xref target="reference-ids-extension-fields">[[this
> memo]]</xref></c>
> @@ -1774,6 +1828,49 @@ Tx  | 0  |    | t3'|      | 0  |    | t3 |
> | 0  |    |t11'|
>          <c>Network Time Protocol version 5 (NTPv5)</c>
>          <c><xref target="network-time-security">[[this memo]]</xref></c>
>        </texttable>
> +
> +      <t>IANA is requested to create a new registry entitled "Network Time
> +        Protocol Source Identifier Types". Its entries SHALL have the following
> +        fields:
> +        <list>
> +          <t>Number (REQUIRED): An integer in the range 0&ndash;255
> inclusive.</t>
> +          <t>Description (REQUIRED): A short text description of the
> identifier type.</t>
> +          <t>Reference document (REQUIRED): A reference to the relevant
> +            specification document.</t>
> +        </list>
> +        The policy for allocation of new entries in this registry SHALL vary by
> +        their Number, as follows:
> +        <list>
> +          <t> 0&ndash;247: IETF Review</t>
> +          <t> 248&ndash;255: Private and Experimental Use</t>
> +        </list>
> +      </t>
> +
> +      <t> The initial contents of the Network Time Protocol Source
> Identifier Types
> +        Registry SHALL be as follows:
> +      </t>
> +
> +      <texttable>
> +        <ttcol>Number</ttcol>
> +        <ttcol>Description</ttcol>
> +        <ttcol>Reference</ttcol>
> +
> +        <c>0</c>
> +        <c>None</c>
> +        <c><xref target="primary-source-extension-field">[[this
> memo]]</xref></c>
> +
> +        <c>1</c>
> +        <c>IpV4</c>
> +        <c><xref target="primary-source-extension-field">[[this
> memo]]</xref></c>
> +
> +        <c>2</c>
> +        <c>IpV6</c>
> +        <c><xref target="primary-source-extension-field">[[this
> memo]]</xref></c>
> +
> +        <c>3</c>
> +        <c>NTP Reference Identifier</c>
> +        <c><xref target="primary-source-extension-field">[[this
> memo]]</xref></c>
> +      </texttable>
>      </section>
> 
>      <section title="Implementation Status - RFC EDITOR: REMOVE BEFORE
> PUBLICATION">
> --
> 2.47.3
> 
> _______________________________________________
> ntp mailing list -- ntp@ietf.org
> To unsubscribe send an email to ntp-leave@ietf.org