Versão em português
NTP - Survey 2005
Pedro Torres - torres at pop-pr.rnp.br
The NTP Survey 2005 is a data collect and analysis from the NTP network. A previous NTP survey and results can be found at:
The IP addresses that will scan the NTP network is 126.96.36.199 and 2001:12f0:100:7::2 whose owner is PoP-PR (point of presence of Brazilian Network Research in Paraná). The reverse DNS for this address is ntpsurvey.arauc.br.
This suggestion has been made to NTP Survey 1999 by Nelson Minar. The purpose is that when an administrator notices an access coming from IP address above he can reach this web page (www.ntpsurvey.arauc.br) with information regarding the survey.
The expected time to scan the entire NTP network is roughly 5 weeks and should start on 08/30/2005. During this period your server may receive one or more queries which responses will be used for statistical analysis only. It won't compromise your network nor NTP server. This scan is not related to any security hole in NTP servers.
The summarized data and possibly a paper will be available this year here (I think!) :)
The basic idea of NTP survey 2005 is to collect data in all hosts avaliable for public access of the NTP network using a program developed with that objective.
The list of available hosts in the NTP network is incremented querying each host previously known which peers recently queried them.
The most important data we are looking for:
The current time;
The delay to communicate with the peer;
The difference between the peer's time and hosts' own (offset);
The estimated error of the peer's clock and root time server (dispersion);
The distance (in seconds) to the root time server;
The version of NTP protocol;
The command that will be executed for each host is:
> ntpdc -n -c sysinfo -c peers -c monlist <IP ADDRESS>
> ntpq -n -c as -c rv "assid" <IP ADDRESS>