Summary

  • A 12-hour DNS census across about 9,000 RIPE Atlas vantage points found 12 IPv4 addresses for Microsoft’s NTP service; more than half of the vantage points received just one.
  • RFC 8633 recommends at least four independent, diverse time sources for operators concerned with accuracy. The answers returned to each client determine how many time sources it can compare.

Analysis

In BigTime: Characterizing Large Time Service Providers, Pascal Huppert and seven co-authors examine what a time-service name returns at the edge of a network. They queried authoritative DNS directly every ten minutes for twelve hours; about 9,000 RIPE Atlas vantage points supplied valid replies across 170 countries.

Microsoft’s NTP service had 12 IPv4 addresses in the study’s inventory; more than half of the measured vantage points received one distinct answer. A separate 60-day campaign observed the same set of 12 addresses.

Atlas records those DNS answers, not the time-source configuration of individual Windows devices. One returned IP may front several machines, so the measurement shows the address choices visible at each vantage point, not a count of machines or independent failure domains.

For operators, the next step is to compare the DNS answers seen at client locations with device source lists, then map routes, operators and failure domains. Two addresses that share a route or control plane may fail together. That is where RFC 8633’s diversity principle becomes operational.

The paper separately tests clock accuracy from four reference-synchronized vantage points: AWS Sweden (SE-AWS), AWS US, AWS Japan and SIDN in the Netherlands (NL-SIDN). Each queried Microsoft’s server addresses every five minutes for 24 hours. SE-AWS received 3,450 of 3,456 replies; 199, or 5.8% of the replies, exceeded the RTT/2 bound. Under the paper’s method, an offset beyond half the round-trip time cannot be explained by path delay alone for synchronized clocks. The authors traced those 199 replies to three Microsoft servers whose clocks were out of sync for several hours.

None of the other three vantage points recorded a Microsoft offset outside the same bound. In the SE-AWS table, the largest listed offset among the affected servers was −50.97 ms.

Pascal Huppert, a second-year PhD researcher in the University of Twente’s DACS group, studies NTP resilience and security. His paper makes the client-visible address set the starting point for an operator’s resilience check: resolve, compare with the device’s source list, then trace shared dependencies.

Sources