Steady traffic increase BE since around midnight CET yesterday

Server operators
8

While it is not clear what is causing this, I have removed the server from the pool, see the dip at the end of the graph.

I think that maybe, just maybe, they are changing GeoDNS to avoid this in-country geolocking.
(there’s no new version of GeoDNS ATM on github, so not sure). I checked the Belgium subzone size and it has not increased a lot lately, say, by adding servers from the NL.

For the technical point of view, this makes tons of sense – clients in BE can get good time services from DE NL and FR, and other neighbors. We looked into it in a research paper.

I did a quick experiment here from the Netherlands. I queried like 100 times for be.pool.ntp.org directly to their auth servers.
In other words, to know what servers are serving Belgium folks.

Results

You can see that DE, CH and NL are serving Belgium-based folks ( Geolocation for US servers is bogus given this service is Cloudflare, which is anycast, so geolocation does not work )

{'US': {'162.159.200.1', '162.159.200.123'},
 'BE': {'109.68.160.220',
  '185.111.204.220',
  '185.153.43.4',
  '185.21.134.11',
  '185.77.12.9',
  '185.89.20.5',
  '193.104.37.238',
  '193.121.15.225',
  '44.31.68.23',
  '45.87.76.3',
  '45.87.77.15',
  '45.87.78.35',
  '80.200.247.170',
  '91.181.42.222'},
 'DE': {'178.215.228.24'},
 'CH': {'156.106.214.48', '156.106.214.52'},
 'NL': {'185.92.222.26'}}

This is good. This is pretty much what Apple, Microsoft, and AWS do.

So technically, it’s good for the Pool.

Policy implications

While it is not clear what is causing this, I have removed the server from the pool, see the dip at the end of the graph.

I think folks have become used to server their own country-fellow folks.. I think you are now serving your EU neighbors, which I think it is also fine. But that is a personal choice..

Other alternatives

current hypothesis is that some vendor/ISP was rolling out new firmware/software to devices, replacing an SNTP client in such firmware/software by an NTP client.

I cannot prove or disprove that, but I think this is quite a difficult change in such short notice. The DNS experiments above suggest these are changes on " modernizing" the pool and stop with this in-country locking.

2 Likes