> Two of my servers are in the NTP pool...
You can get some interesting data if you kick up the memory for the MRU list.
A US/NA server needs 325K to hold everything for a bit over a day.
Something like:
# 88200 = 86400 + 30*60
mru initmem 100000 maxmem 500000 maxage 88200 minage 3600
addresses: 3776369
peak addresses: 3776369
maximum addresses: 5818181
reclaim above count: 600
reclaim maxage: 90000
reclaim minage: 3600
kilobytes: 324532
maximum kilobytes: 500000
alloc: exists: 307642121
alloc: new: 3776369
alloc: recycle old: 29055766
alloc: recycle full: 0
alloc: none: 0
age of oldest slot: 93040
You can get interesting data with things like:
/usr/local/bin/ntpq -nc "mru mincount=100000 sort=avgint" <target>
/usr/local/bin/ntpq -nc "mru mincount=1000 sort=avgint" <target>
lstint avgint rstr r m v count rport remote address
=====================================================
1 0.937 90 . 3 3 1012928 64804 40.141.174.100
0 0.978 90 . 3 3 970637 38709 40.141.174.101
1 1.04 90 . 3 4 908887 62930 131.107.174.109
2 1.79 90 . 3 3 530453 50166 207.144.49.170
48 2.40 90 . 3 4 394639 123 204.186.6.242
224 2.80 90 . 6 2 338600 36832 ::1
3 2.94 90 . 3 4 322787 52223 107.20.175.217
lstint avgint rstr r m v count rport remote address
=====================================================
88061 0.035 90 . 3 1 10621 2820 179.184.94.28
37706 0.051 90 . 3 3 2379 58422 97.73.10.130
10229 0.060 90 . 3 4 2527 62353 76.216.210.22
28937 0.061 90 . 3 4 2494 61253 104.63.129.67
29542 0.066 90 . 3 3 1778 26527 173.197.81.172
4570 0.069 90 . 3 3 1385 54757 71.92.220.153
51592 0.070 90 . 3 3 1647 42172 73.222.215.112
49602 0.071 90 . 3 3 1071 45130 2601:645:c200:b515:d909:1f4d:bf9a:c605
11013 0.072 90 . 3 3 1869 42659 2605:e000:151e:41f1:3113:1583:3b3c:dfac
92275 0.075 90 . 3 3 2002 60707 76.170.7.110
10319 0.081 90 . 3 3 1062 52116 67.170.129.17
44856 0.081 90 . 3 3 1196 40647 73.19.92.143
49304 0.083 90 . 3 3 1806 47957 204.106.232.226
-------
If you want to get the whole thing, you have to run on the same system or new
data arrives faster than you can retrieve it. I use "direct" mode to avoid
using lots of memory. (and -n to avoid DNS thrashing)
Direct mode will get duplicates when another packet arrives after you have
read a slot. (The slots are returned oldest first or rather newest last so
any packet bumps that slot up to the top/last of the list.)
--
These are my opinions. I hate spam.
_______________________________________________
devel mailing list
devel@ntpsec.org
http://lists.ntpsec.org/mailman/listinfo/devel
