[time-nuts] Network Time Puzzle

[Peter Martinez]

Steve:

Many thanks for that link to  your paper on NTP 
http://leapsecond.com/ntp/NTP_Paper_Sommars_PTTI2017.pdf

I read the entire paper, not just figs 7 and 8, and it explains everything. 
I was beginning to doubt my own sanity because several authorities that I 
had consulted told me quite categorically that The Network would have no 
business looking at source port addresses within packets, and would have no 
reason to treat packets from some port addresses differently from packets 
from other port addresses.   I had in particular consulted a named person at 
one organisation which operates ntp servers in Colorado and Maryland.  I had 
spotted this effect first on ALL their servers and had not, at that time, 
seen it on any others, so I had good reason to ask them whether there could 
be something at their end which might be responsible.  "No there isn't - our 
servers are OK" I was told, but nothing more.

I could still make a valid point which could be of concern to writers of ntp 
client software.  If a client used a fixed, constant, local port address, we 
can assume that routers in the internet (or at least those which do 
implement this load-spreading technique) would route all ntp traffic - from 
client to server and back - via the same path each time, so there would be 
no spread in offset times seen by the client.  There might, of course, be 
some asymetry in the paths.  By contrast, a client that used a different 
local port address for each query might see a different route each time and 
there would be a spread in offset times of the same order as the spread in 
propagation times of the routes in use.

For example, I have seen, when querying servers in Colorado and Maryland 
from here (the UK), standard deviations in the derived offset, of about 
100usec when I use a fixed local port address, and about 3 msec when I use a 
port address which either increments by 1 for each query or is chosen as a 
random number between 49152 and 65535 each time.  I am not sure of the 
statistics, but I am not sure that randomizing the local port address has 
any useful advantages.

Just for amusement I implemented a process whereby my client program starts 
with a randomized port address, but keeps a record of the port number of the 
query which gives the lowest round-trip-time during this "search" phase, 
then switches to this fixed port address thereafter.  The offset thus 
achieved was always "better" than with any other random choice of fixed port 
address.  Maybe this is going too far!

Steve: Thanks again.  VERY useful.
Peter