Summary

  • Mills's 1988 survey queried 5,722 hosts and gateways; 1,158 supplied local time. Sixty percent of those time replies missed by over a minute, ten percent by over thirteen minutes, and a few by as much as two years, as he recounted in RFC 1128.
  • In August 1989 his team attempted 107,799 host addresses. The report followed the trail through responses, plausible clocks and selected NTP reference paths, then measured about 33,000 samples across six primary servers. A number on a clock face became a testable claim.

The Internet had learned to connect machines. Getting them to agree on Tuesday was another project. In the introduction to his October 1989 report, David L. Mills described the 1988 reconnaissance: 5,722 hosts and gateways asked, 1,158 willing to tell the time. Of the replies, three in five were more than a minute out; one in ten missed by over thirteen minutes. A few missed by years. Imagine an office where every employee has a watch, and one insists the meeting happened before the company was founded.

Mills's RFC 1128 turned that alarming anecdote into a measurement campaign. The first problem was finding whom to ask. The familiar NIC host table contained 6,382 distinct addresses on 10 August 1989. A newer table compiled from the domain-name system held 137,484 entries. After unusable addresses were discarded and the list sorted, the experiment used a control file of 112,370 entries. Nine days of August probing from the University of Delaware attempted 107,799 distinct host addresses. The numbers describe successive stages of a search, not interchangeable estimates of how many machines lived online.

Each candidate could receive questions in three protocols: ICMP Timestamp, the older TIME service, and NTP. The program retried once after a second and could collect up to eight samples per protocol. It often stopped early: if ICMP failed, it generally skipped TIME; if TIME failed, it generally skipped NTP. That saved traffic and made the survey practical. It also meant a silent ICMP responder might have concealed a perfectly talkative NTP service. The method shaped the population that entered the results.

Of 107,799 attempted addresses, 94,260 produced some sort of statistics entry. Mills reported 20,758 apparently valid time indications among those entries. Repeated attempts and multiple protocols could still name the same host. After preference and deduplication rules, the report gave 8,455 hosts with apparently valid time. These are three different doors in the funnel: probed address, observed indication, retained host. A headline that divides one by another without opening the methods section has already lost the plot.

The clocks that answered were a motley parliament. Mills plotted the chance that an error exceeded a given size, because a beautiful average conceals the machine sitting in last week. Eight NTP hosts were more than ten seconds wrong; he suspected older implementations with known bugs in some or all of them. At the ragged edge, roughly one percent of ICMP Timestamp hosts were off by over a day, and one percent of TIME hosts by more than a few hours. The NTP group generally kept time about a thousand times more accurately than those two older services in this survey. The comparison speaks for these observed groups and their selection rules.

Then the experiment changed scale. For two weeks in August 1989, Delaware measured six selected primary NTP servers on paths spanning the United States, gathering roughly 33,000 offset-and-delay samples. One deliberately rough path to USC's Information Sciences Institute crossed as many as twelve hops. Its 2,214 samples produced a median raw offset of minus twelve milliseconds and a filtered offset of minus nine. Filtering brought the reported delay median from 269.5 to 220 milliseconds because the filter selected different observations; the cables did not suddenly become shorter.

In the filtered path data Mills reported median error of a few milliseconds and a maximum of fifty.

The radio clocks anchoring those servers had their own weather. A modeled radio path from Delaware to Ottawa's CHU varied between 2.7 and 5.1 milliseconds as propagation geometry changed. The time source was physical, the network was noisy, and both could move the answer. Mills ended with a shopping list: better radio clocks, better timebases, sharper frequency estimates, closer monitoring. His achievement was a way to say which clock, which path, which sample and which error. The Internet could finally put its punctuality on a chart, including the embarrassing dots.