# Recent NTP pool traffic increase **URL:** \ **Category:** Server operators\ **Created:** [December 20, 2016, 2:49am UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18 "2016-12-20T02:49:49Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![ddrown](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ddrown/32/11_2.png) [@ddrown](https://community.ntppool.org/u/ddrown)\ **Post date:** [December 20, 2016, 2:49am UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/1 "2016-12-20T02:49:49Z")
IPv4 Traffic started increasing on Dec 13. IPv6 traffic was unchanged (times in this graph are US/Central) ![](https://us1.discourse-cdn.com/flex016/uploads/ntppool/original/1X/0e2024175f3bdfa00d059524376c001168ff4905.png) Traffic follows the pattern of peaks in the US Daytime/evening, valleys in the US nighttime. Traffic was seen to a wide variety of different regional NTP pools: New Zealand, United Kingdom, United States, Japan, etc. Traffic is coming primarily from US networks: Cable, Cell Phone, and DSL/Other (times in this graph are UTC): ![](https://us1.discourse-cdn.com/flex016/uploads/ntppool/original/1X/db94a5f759782e8acb95ba0b5122ad7132d92615.png) Reports of NTP traffic increases from NTP server operators and NTP in access networks have been in the range of “5x - 20x” normal levels. The majority of traffic (\>50%) has the following NTP flags set: ``` NTPv4, length 48 Client, Leap indicator: (0), Stratum 0 (unspecified), poll 4s, precision -6 Root Delay: 1.000000, Root dispersion: 1.000000, Reference-ID: (unspec) Reference Timestamp: 0.000000000 Originator Timestamp: 0.000000000 Receive Timestamp: 0.000000000 ``` Traffic seems to be from many different sources and not concentrated to any one source IP. All these facts combined suggest the traffic is coming from: Human Activity on a Mobile Device (Phone/Tablet/Laptop) The most popular Android applications (including Snapchat) were installed on a test phone and none of them generated NTP activity. The base Android system was seen to send NTP requests to [2.android.pool.ntp.org](http://2.android.pool.ntp.org) iPhones and iPads were tested, and the iOS system only sent NTP traffic to [time-ios.apple.com](http://time-ios.apple.com) **Snapchat was installed on multiple iPhones, and this caused the iphone to lookup the following hostnames in DNS and send NTP to each unique IP returned** : ``` 0.pool.ntp.org 0.uk.pool.ntp.org 0.us.pool.ntp.org asia.pool.ntp.org europe.pool.ntp.org north-america.pool.ntp.org south-america.pool.ntp.org oceania.pool.ntp.org africa.pool.ntp.org ``` This matches the list embedded in this iOS NTP library: [https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/NetworkClock.m#L121](https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/NetworkClock.m#L121) The NTP flags on the majority of NTP traffic also match the ones set here: [https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/NetAssociation.m#L254](https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/NetAssociation.m#L254) Snapchat has posted a fix to iTunes (Dec 20) and the update is slowly rolling out - [https://mailman.nanog.org/pipermail/nanog/2016-December/089610.html](https://mailman.nanog.org/pipermail/nanog/2016-December/089610.html) Credit for this information comes from a lot of different sources. Thanks to everyone that helped out! ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [December 20, 2016, 3:54am UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/2 "2016-12-20T03:54:58Z")
I made a [github issue](https://github.com/jbenet/ios-ntp/issues/47) on the library with the hardcoded [pool.ntp.org](http://pool.ntp.org) zone names. As people pointed out on IRC, using the continent names doesn’t make much sense in virtually all cases. That we have them is really mostly a historical artifact. :-/ (Probably it’d make sense to deprecate them on the website). ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [December 20, 2016, 9:08am UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/3 "2016-12-20T09:08:02Z")
A post was split to a new topic: [Software and devices without a vendor zone](https://community.ntppool.org/t/software-and-devices-without-a-vendor-zone/28) ---
**Author:** ![ddrown](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ddrown/32/11_2.png) [@ddrown](https://community.ntppool.org/u/ddrown)\ **Post date:** [December 20, 2016, 7:16pm UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/4 "2016-12-20T19:16:51Z")
Snapchat has posted a fixed application to iTunes (pending approval). I’ve updated the first post with that info. ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [December 20, 2016, 11:11pm UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/5 "2016-12-20T23:11:05Z")
Reports on IRC says that the update is out now and in initial testing by Leo Bodnar it appears to not do NTP queries anymore (or at least more selectively…). ---
**Author:** ![ddrown](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ddrown/32/11_2.png) [@ddrown](https://community.ntppool.org/u/ddrown)\ **Post date:** [December 20, 2016, 11:44pm UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/6 "2016-12-20T23:44:03Z")
This graph shows the NTP traffic matching the ios-ntp library fingerprint on my NTP server: ![](https://us1.discourse-cdn.com/flex016/uploads/ntppool/original/1X/94463cd8243d4c40a11e70e70e57bf281de4c55d.png) ---
**Author:** ![ddrown](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ddrown/32/11_2.png) [@ddrown](https://community.ntppool.org/u/ddrown)\ **Post date:** [December 21, 2016, 10:39pm UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/7 "2016-12-21T22:39:02Z")
NTP Traffic today is down roughly 25% compared to yesterday, which is a good sign. ---
**Author:** ![ddrown](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ddrown/32/11_2.png) [@ddrown](https://community.ntppool.org/u/ddrown)\ **Post date:** [December 21, 2016, 11:35pm UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/8 "2016-12-21T23:35:29Z")
Snapchat added NTP servers to the Australia and Brazil pools last night as well - [https://mailman.nanog.org/pipermail/nanog/2016-December/089620.html](https://mailman.nanog.org/pipermail/nanog/2016-December/089620.html) ---
**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\ **Post date:** [December 22, 2016, 7:33am UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/9 "2016-12-22T07:33:51Z")
Tom Yates wrote a [nice article](https://lwn.net/SubscriberLink/709874/897da32421e37810/) about this for LWN, though I think he got the affect on the pool wrong. The big zones managed okay in terms of server loss, but in particular [South America](http://www.pool.ntp.org/zone/south-america) and [Africa](http://www.pool.ntp.org/zone/africa) were barely sustaining already and got decimated pretty badly. The server count graph for [Australia](http://www.pool.ntp.org/zone/au) also looks pretty sad (it already wasn’t very good). ---
**Author:** ![josephb](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/josephb/32/7_2.png) [@josephb](https://community.ntppool.org/u/josephb)\ **Post date:** [December 30, 2016, 1:19pm UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/10 "2016-12-30T13:19:17Z")
> [@ddrown](#): > > NTP Traffic today is down From the viewpoint of a server in the US pool, things are largely back to normal although traffic is still slightly elevated than prior to the event. The graphs below show received packets per second and bandwidth in/out for a server in the US pool with “Net speed” 50mbps. ![](https://us1.discourse-cdn.com/flex016/uploads/ntppool/original/1X/f79d06d6d7e85e0038ff19542fece28d1fc3a2a3.png) ![](https://us1.discourse-cdn.com/flex016/uploads/ntppool/original/1X/9ca2e1fa3bd089a0fe0a72eb88b7f301a2302ec3.png) ---
**Author:** ![juleskers](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/juleskers/32/97_2.png) [@juleskers](https://community.ntppool.org/u/juleskers)\ **Post date:** [April 19, 2017, 8:18am UTC](https://community.ntppool.org/t/recent-ntp-pool-traffic-increase/18/11 "2017-04-19T08:18:36Z")
Hello everyone! (sorry for sort-of necro-ing) I stumbled upon this fascinating event via the [wikipedia entry](https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Snapchat_on_iOS). That entry still represented the state of Dec 20th, i.e. in the heat of battle, before fixes were applied. I took the liberty of bringing the wiki-entry up to date. I hope I’ve characterised the aftermath correctly. I’d like it if someone more familiar to have a look at [my changes](https://en.wikipedia.org/w/index.php?title=NTP_server_misuse_and_abuse&action=historysubmit&type=revision&diff=776151656&oldid=773118962), and update in case I missed anything or struck the nuances wrong. I’d hate to misrepresent the awesome work this community is doing!