[comp.protocols.tcp-ip] Timewarp alert

Mills@UDEL.EDU (05/16/88)

Folks,

At about 2000 UT Saturday the NCAR primary NTP time server took a hit, with
result that until about 1800 UT Sunday the year read 99, not 88. At about
0100 UT Saturday the UDel primary NTP time server also took a hit and
chimed similar nonsense until fixed about an hour later. In all the NTP
primary servers the year is determined (from a file) at boot time and can
be changed subsequently only by an operator command. The year information
is not part of the timecodes broadcast by NBS. In fact, I can find no
evidence of TCP login near the time of warp in either case and have
no reason to suspect operations staff at either location of any mischief.
I therefore tentatively have classified the warps as zoo events and have
alerted the hacker trackers.

Those brave enough to be chiming NTP with one or more of the five NTP
primary time servers should read Appendix D of the document found
in the ~ftp/pub/ntp.doc file in the anonymous login at louie.udel.edu.
This appendix suggests that secondary NTP time servers should peer with
two of the five primary servers along with another secondary server known
to peer with two different primary servers. The voting algorithm used
by the Fuzzball and Unix daemons is designed to cast out falsetickers
most effectively in such configurations.

Dave