Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd)

[Sergei_Shablovsky]

@JKnott said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

@Patch said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

Chrony is a better time server so I use it.

In what way? It can have accuracy comparable to PTP, but only if your source is that accurate. This means you'd need your own stratum 0 source, such as GPS or the cell phone network. IIRC, GPS is supposed to be accurate within 30 nS and the cell network within 1.5 uS. If you're using a source on the Internet, it won't get you much. If you do have your own stratum 0, you might also want to get one of those Facebook atomic clock cards to use with it.

Thank You for very interesting link. I hear about but now see the real results, need to dive in …:)

I do understand it has some advantages for devices that are not always connected to the Internet.

No, this would be more for systems that may suffer from GPS spiffing and jamming (war in Ukraine, war in Israel and possible next escalation between China and US, EU and russia, South and North Koreas - all this rapidly involves civil GSM technologies right now …).

PTP is designed for networks where extremely precise timing is necessary, including with SyncE, but other than that, it would be hard to justify worrying about it.

If I understand all “time card” docs and specifications, bulky and proprietary rack time-servers would be replaced by tiny 1CPU server with 2xPSU and this “time card” (and a little bit antennas from server room to rooftop;)

BTW, I cannot read anything about how to resolving radio interference on antennas in server room… Looks like developers are focused more on electronics and less on radio/antennas-related things. Am I wrong?

[Sergei_Shablovsky]

@dennypage said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

Yes, chronyd is a much better time keeper than ntpd. ~1us vs a few tens of us against a local stratum 1. But still, a few 10s of us is pretty damn good. But that kind of precision isn't that important for a firewall.

Hm… Are You sure that chrony are enough for speeds 10G+ per interface? :)

[JKnott]

@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

Need to note that local RS-232 directly (not through RS-232<~>USB adapter) connected GPS receiver with PPS signals OR GSM receiver with PPS signal -> are Stratum 1.

I have wondered about this. While the instantaneous time could be off with USB, NTP averages in the long term. How much is the clock in error after it's been running for a while?

Stratum 0 - this is for local-connected atomic clock. Yeah, some hi-education Institutes, financial and militarily of course in US already have it. ;)

The source, such as GPS, is stratum 0 and the first NTP server is stratum 1. The atomic clock provides stability to the local time.

BTW, one thing some people don't seem to understand is NTP is supposed to be traceable to International Atomic Time. A few years ago, I was working on a project for a light rail transit system in Toronto. The spec called for the NTP servers to be connected to the parent company's NTP server, falling back to the GPS receivers should that connection fail. Whoever wrote that clearly had no idea how NTP worked. They should have said to peer or at least be a client of the parent NTP servers, in addition to GPS. Since both the local and parent NTP servers were traceable back to IAT, there should be no significant difference between them.

Here's an interesting read about time:
From Sundials To Atomic Clocks

[JKnott]

@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

If I understand all “time card” docs and specifications, bulky and proprietary rack time-servers would be replaced by tiny 1CPU server with 2xPSU and this “time card” (and a little bit antennas from server room to rooftop;)

BTW, I cannot read anything about how to resolving radio interference on antennas in server room… Looks like developers are focused more on electronics and less on radio/antennas-related things. Am I wrong?

I'm not sure what you're getting at, but if that's a concern just put the receiver someplace other than the server room. In fact, GPS might not work at all in a server room simply because the signal is blocked by reinforced concrete.

I had an example of this when I worked at IBM. My office was in the Canadian HQ and the building held about 5000 employees. You could get FM radio reception near the windows, but not if you were well away from them.

[dennypage]

@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

Need to note that local RS-232 directly (not through RS-232<~>USB adapter) connected GPS receiver with PPS signals OR GSM receiver with PPS signal -> are Stratum 1.

Stratum 0 - this is for local-connected atomic clock. Yeah, some hi-education Institutes, financial and militarily of course in US already have it. ;)

• Stratum 0 is any reference clock. It may be an atomic clock, GNSS receiver, WWV receiver, a crystal oscillator from your watch, etc.
• Stratum 1 is the system (host) directly connected to the reference clock offering NTP services.

Yes, you can actually have a USB connected GPS stratum 0 device. They were done as a special project by Eric Raymond, the original author of gpsd. They're rare, but I think you can even still buy one. Good for a few milliseconds. I probably still have one in a box somewhere, along with several other of my early stratum 0 devices.

[dennypage]

@JKnott said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

BTW, one thing some people don't seem to understand is NTP is supposed to be traceable to International Atomic Time.

Traceability is to Coordinated Universal Time (UTC) rather than International Atomic Time (TAI). There's a 37 second difference.

[stephenw10]

@dennypage said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

There's a 37 second difference.

Gah. indeed!

[JKnott]

@dennypage said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

Traceability is to Coordinated Universal Time (UTC) rather than International Atomic Time (TAI). There's a 37 second difference.

UTC is based on IAT and then adjusted for leap seconds. From that article I linked to:

"International Atomic Time (abbreviated TAI, from its French name temps atomique international[1]) is a high-precision atomic coordinate time standard based on the notional passage of proper time on Earth's geoid.[2] TAI is a weighted average of the time kept by over 450 atomic clocks in over 80 national laboratories worldwide.[3] It is a continuous scale of time, without leap seconds, and it is the principal realisation of Terrestrial Time (with a fixed offset of epoch). It is the basis for Coordinated Universal Time (UTC), which is used for civil timekeeping all over the Earth's surface and which has leap seconds."

[JKnott]

@stephenw10 said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

@dennypage said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

There's a 37 second difference.

Gah. indeed!

That's already adjusted for with UTC.

[dennypage]

@JKnott While UTC uses TAI as the basis for Top Of Second (TOS), TAI does not have any concept of leap. UTC, which does have leap, is the basis for NTP.

[Sergei_Shablovsky]

@JKnott said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

If I understand all “time card” docs and specifications, bulky and proprietary rack time-servers would be replaced by tiny 1CPU server with 2xPSU and this “time card” (and a little bit antennas from server room to rooftop;)

BTW, I cannot read anything about how to resolving radio interference on antennas in server room… Looks like developers are focused more on electronics and less on radio/antennas-related things. Am I wrong?

I'm not sure what you're getting at, but if that's a concern just put the receiver someplace other than the server room. In fact, GPS might not work at all in a server room simply because the signal is blocked by reinforced concrete.

I say You more: even ordinary green leafs may blocking the GPS signal from satellite…:)

Maximum shielded wire connection to GPS satellite (!!!, no GSM-source from cellular base station nearby!) antenna to small electrical scheme and than for motherboard’s DB-9 of RS-232 MUST BE LESS than ~15m.

This also mean that You need place the GPS satellite antenna to rooftop where are 180 degrees on both X and Y axes of clear sky view to receive signals from no less than 3 satellite. And no any skyscrapers nearby, no any big trees or hi-powered (3-5-20kWA electrical lines) on a distance 50-200m.

So, back to the server room, as a result You have only 2-3m of this shielded wire from hole in the wall to DB-9 of RS-232 in server.

But anyway, it’s not “just put the GPS antenna somewhere out of the server room”. Definitely not.

[stephenw10]

I have found it surprising how well GPS works with a restricted view of the sky. Of course when you look into GPS it's amazing it works at all.

[RobbieTT]

@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

Maximum shielded wire connection to GPS satellite (!!!, no GSM-source from cellular base station nearby!) antenna to small electrical scheme and than for motherboard’s DB-9 of RS-232 MUST BE LESS than ~15m.

This also mean that You need place the GPS satellite antenna to rooftop where are 180 degrees on both X and Y axes of clear sky view to receive signals from no less than 3 satellite. And no any skyscrapers nearby, no any big trees or hi-powered (3-5-20kWA electrical lines) on a distance 50-200m.

So, back to the server room, as a result You have only 2-3m of this shielded wire from hole in the wall to DB-9 of RS-232 in server.

But anyway, it’s not “just put the GPS antenna somewhere out of the server room”. Definitely not.

I scratching my head a little at what you are aiming at but little of what you say here is true. I can help to resolve these errors though.

You don't need an antenna from a roof to a server; indeed, in many situations this would be a bad idea. GPS time source equipment can be colocated with, close to or even combined with the antenna. This time source can then be distributed by the network cabling - it is a network time after all.

You don't need 180º X & Y view of a clear sky - far from it. With that kind of view you would, at times, exceed 12 satellites. Additionally, GPS orbits are far from geostationary. The rip around our planet pretty quickly in predictable patterns for the GPS almanac to form a dynamic lattice that, from a receiver's perspective, will provide suitable sources with only a limited amount of LoS available. It is a far cry from where we started, when we had a limited constellation and warfare cognisant of GPS-dawn and sunset.

Regarding satellites needed, for a meaningful position you really need 4 satellites, dropping to 3 if a known or predictable height is available. But yes, if you are driving your server room and roof around Manhattan then having more satellites available would help. If your building is more known for being immovable and even surveyed as such then you only need a view of 1 GPS satellite at a time to use GPS timing.

Of course, GPS is not for everyone and even it it was the usual redundancy and diversity considerations would see it augmented by dedicated fibre, ToD receivers, GSM, ToD beacons plus atomic clocks et al. Whilst my experience is more at the strategic scale of GPS management I do have a Veracity Timenet GPS unit on my home network. My network rack is surrounded by concrete and below any achievable LoS and I would never run an external antenna directly to it.

I do have an external pole-mount antenna in a box but waiting for the next round of roof work to fit it. I'm in no hurry as the network GPS receiver has a simple patch antenna on an upstairs window with a short cable to the receiver, which is plugged into the nearby ethernet socket. Even In this 'terrible' location it has at least 8 satellites to work with.

Not everything is difficult.

️

[RobbieTT]

This is how craptostic a timing reference can be located - at the rarely photographed arse-end of my network. The blue arrows are the GPS/PPS network timing box, stuck on the backside of a bedroom TV and the patch antenna sitting on a window sill:

The secret to comedy.

️

[johnpoz]

@RobbieTT yeah I use to have the antenna just sitting on the top of my desk in my office and would work.. I did move it to the garage a while back and the antenna sits on top of the garage door railing.. Can see more sats from there. I believe my problems in the office started after we added way more insulation in the attic.. There is no insulation above it where its at in the garage.

The pi sits behind my TV in living room, where the cable runs through the wall into the garage..

I am not a guru when it comes to the stuff, but it is fascinating to me. From my understanding the time from the sats to be accurate you need to work out some math and set a fudge, etc. to account for stuff. I was just more after the pps signal the gpshat provides once it can see enough sats.. I never bothered to work out the correct fudge factor

While I might be off by a few ms of "true" time.. It was a fun project to setup, and for sure is close enough for me.. My little pi ntp server also polls just ntp servers out on the internet. From the output of ntpq the gps time on shm (0) is not even a candidate, if the pps source would go away.

Which was my problem I was seeing, couldn't see enough sats to get sync I believe and so pps was never kicking in. Once I moved the antenna to the garage that started working again.. From the output of cgps shows I can see a lot of sats.

But it for sure worked before just with the antenna in my office.. Not even near a window, etc.

I think the total cost, with the pi was under a hundred bucks total.. The pi, the hat, the little antenna, everything. And I already had the pi so cost of the project was just the hat, the antenna to be honest.. ntp and talking to sats is for sure a fun little project, if this sort of stuff interests you.. And can be done for very reasonable "hobby" money if you will.

Is my little ntp server providing "true" time that you would need in some scientific setting - prob not.. But it very stable, ie it doesn't drift much and I like having it running it on my network and syncing all my devices too it.. Even if its off by a few ms from "true"..

[stephenw10]

@RobbieTT said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

The secret to comedy.

Ha

[JKnott]

@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

But anyway, it’s not “just put the GPS antenna somewhere out of the server room”. Definitely not.

You put the receiver and NTP server elsewhere, where there is a signal. Nothing new here. Often, both devices are in the same box. Here is one example.

[JKnott]

@RobbieTT said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

GSM

GSM is dying, if not already dead in most areas. These days, a 4G or 5G network can provide 1.5 µS accuracy. It will likely work better than GPS in many locations.

[RobbieTT]

@JKnott said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

@RobbieTT said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):

GSM

GSM is dying, if not already dead in most areas. These days, a 4G or 5G network can provide 1.5 µS accuracy. It will likely work better than GPS in many locations.

Not sure why you picked-out GSM time reference from the list but the world is a big place and GSM-based time reference systems are out there in use for everything from military, police, ATC, banking, PoS, trading, networking, power networks, gas network, train signal & monitoring... and the list goes on.

I happen to live on a bit of the planet that is more advanced than other areas and we have a desire is to cease GSM use by 2033 (IIRC) but given that there are still major infrastructure elements that are not on track to meet that deadline some slippage will probably occur.

Again, we are talking timing reference use, not using a phone to call your kids. Most of the population of any given country does not have a clue about RF spectrum management let alone any idea* as to what uses or depends on GSM.

️

[* Ok, this bit varies by country. Here in the UK there is growing public awareness that the typical domestic gas and electric meter will become 'dumb' soon and that medical service providers for home equipment (dialysis, CPAP, respirators etc) have quite a problem. But the average punter has no idea about substations, sewage, hydroelectrics or indeed all the other infra held together on obsolescent tech.]

[JKnott]

@RobbieTT

In many areas, GSM is gone. On my carrier, it's already been reduced to 1 band from 2. Also, spectrum costs the cell companies a lot of money. Do you think they're going to leave some spectrum they already have to sit almost unused and then spend on more spectrum? Already we're hearing about things like security systems and more not working because 2G & 3G are being discontinued. The world moves on and sticking with obsolete tech is not the way to go, even if there still is some GSM in your area. A few years ago, a friend received a free 4G phone because the company he was with was in the process of shutting down 2G & 3G.

So, hang onto your GPS time source for as long as you can, but don't be surprised if it stops working some day.

Another source which you didn't mention was NTSC TV signals. Some stations transmitted the time during the horizontal blanking interval and the colour burst oscillator was an excellent stable signal. Are those stations supposed to keep broadcasting, even though NTSC is rarely used these days?