Off by N second errors

[Steven Sommars]

I look for NTP anomalies, particularly those from stratum 1 servers.  One
recurring theme is a server that is briefly in error by an integral number
of seconds.  Recently I noticed such an error from khronos.mikieboy.net,
which is operated by Michael Simpson.  Mike has been involved in ntpsec and
is on this list, so I'm taking this opportunity to investigate the issue.

My monitoring clients send and receives NTP mode 3/4 packets; UDP port 123
traffic is captured. Here's what happened seen from the NTP server's IPv6
address
                            T2-T1    T4-T2  RootDelay RootDisp
                            (msec)   (msec)   (msec)   (msec)
2020-05-22 09:17:08.097891   66.25    59.43 0.000000    1.022339
   <no responses>
*2020-05-22 09:34:05.125206 2066.16 -1942.49 0.000000    0.991821*
2020-05-22 09:37:09.148401 2069.88 -1936.96 0.000000 2000.854492
2020-05-22 09:39:04.715381 2062.72 -1938.76 0.000000 2002.593994
2020-05-22 09:42:06.862968 2062.31 -1937.73 0.000000 2005.325317
2020-05-22 09:44:04.343357 2062.29 -1940.55 0.000000 2007.080078
2020-05-22 09:47:06.972433 2072.26 -1941.69 0.000000 2009.826660
2020-05-22 09:49:04.433926 2066.29 -1943.75 0.000000 2011.596680
2020-05-22 09:52:08.204266   61.54    56.75 0.000000    0.991821
2020-05-22 09:54:06.722796   62.68    59.54 0.000000    1.037598
The responses in blue are in error by 2 seconds. The underlined response
claims a root dispersion of 1 msec making it a falseticker.   Per Mike:

Khronos is using git head of ntpsec and GPSD.
It’s a raspberry pi 3 running buster.
Ublox MAX-M8Q from uputronics.

>From ntp.conf:

# GPS PPS data reference (NTP1)
refclock shm unit 1 minpoll 1 maxpoll 4 refid PPS prefer
# GPS GPS reference (NTP0)
refclock shm unit 0 minpoll 4 maxpoll 4 time1 0.1000 refid GPS

Plus one local stratum 1 & two stratum 2 servers.

There was a similar occurrence for the same server on 2020-01-15.  This
seemed to have happened when the server had just initialized.

A stratum 1 GPS should never be in error by two seconds, or even one
second.  What happened?  Note that T2 is two seconds in the future, so
stale NMEA data won't explain it.

Any similar observations? Known problems ?

Steve Sommars
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/devel/attachments/20200526/00bc0ffc/attachment.htm>